Evidence of meeting #94 for Industry, Science and Technology in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was c-27.

A recording is available from Parliament.

On the agenda

MPs speaking

Also speaking

Daniel Konikoff  Interim Director of the Privacy, Technology & Surveillance program, Canadian Civil Liberties Association
Tim McSorley  National Coordinator, International Civil Liberties Monitoring Group
Matthew Hatfield  Executive Director, OpenMedia
Sharon Polsky  President, Privacy and Access Council of Canada
John Lawford  Executive Director and General Counsel, Public Interest Advocacy Centre
Yuka Sai  Staff Lawyer, Public Interest Advocacy Centre
Sam Andrey  Managing Director, The Dais, Toronto Metropolitan University

4:50 p.m.

Managing Director, The Dais, Toronto Metropolitan University

Sam Andrey

May I just add quickly to that?

Let's not also make the same mistake we did with the Privacy Commissioner. If it's going to be set up as an independent agent, then it has information-sharing powers with the government and with other commissioners. A lot of these investigations are going to span competition, privacy and other functions.

4:50 p.m.

NDP

Brian Masse NDP Windsor West, ON

That's actually a good point, Mr. Andrey. With that, though, would you agree with its having more of a confidential quarter to it? At some point there has to be public accountability in terms of, especially when a decision is made, balancing out the private investment that's taking place with, too, full accountability to the public about how and when a decision was made and why.

4:50 p.m.

Managing Director, The Dais, Toronto Metropolitan University

Sam Andrey

Yes, absolutely. I think just information-sharing powers to enable that investigation...but yes, of course, when it comes to enforcement or a fine or a decision, it should be clear who is doing what

4:50 p.m.

NDP

Brian Masse NDP Windsor West, ON

Thank you, Mr. Chair.

Thank you to the witnesses.

4:50 p.m.

Liberal

The Chair Liberal Joël Lightbound

Thank you to all.

Just before I turn to Mr. Vis, I'd like to seek unanimous consent from committee members. As you all know, we received a Standing Order 106(4) to study the SDTC affair. Based on the timeline, we would need to study it on Monday. I am asking for unanimous consent to do it on Tuesday. We have a committee meeting on Tuesday, but so far the invited witnesses have declined, so that would be a good use of committee time.

If all are in agreement, we would do it on Tuesday. Do I have unanimous consent?

4:50 p.m.

Some hon. members

Agreed.

4:50 p.m.

Liberal

The Chair Liberal Joël Lightbound

Thank you so much.

Mr. Vis, the floor is yours.

4:50 p.m.

Conservative

Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC

Thank you, Mr. Chair.

Mr. Hatfield, last year OpenMedia gave Bill C-27 a failing grade of D. Referring specifically to protections for children, how would you grade the protection of children in Bill C-27?

4:55 p.m.

Executive Director, OpenMedia

Matthew Hatfield

I think it's good to have some unique protections and to force companies to handle them slightly differently. I do think we need to ask ourselves whether many of the protections enjoyed by children shouldn't be enjoyed by everyone in Canada. It's sometimes not clear why only children deserve certain standards of protection.

Really, giving ongoing informed consent, and withdrawable consent, to everyone would be valuable.

4:55 p.m.

Conservative

Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC

Okay.

Bill C-27 does not include a definition of “sensitive information”, yet it does outline that children's data would be subject to sensitive information. Do you think it's problematic that the government did not include a definition of sensitive information for both general purposes and specifically for children?

4:55 p.m.

Executive Director, OpenMedia

Matthew Hatfield

Yes, absolutely. At the very least, have an indication of how that would be determined by regulation.

4:55 p.m.

Conservative

Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC

Do you think it's ethically wrong if the government enables companies to have the ability to monetize biometric and data locations of children and to sell that information for a profit?

4:55 p.m.

Executive Director, OpenMedia

Matthew Hatfield

Yes, I do, but I also think it's ethically wrong for adults. I think we should both be protected from that.

4:55 p.m.

Conservative

Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC

Okay.

Would OpenMedia support amendments that would specifically address protecting biometric information for children and their location information?

4:55 p.m.

Executive Director, OpenMedia

Matthew Hatfield

Yes, depending upon the wording. Our feedback might end up being that we should extend this to everyone, with a small extra portion of privacy for children.

4:55 p.m.

Conservative

Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC

Thank you.

Ms. Polsky, what in your mind are some of the biggest gaps in Bill C-27's protection of children, beyond the sensitive information that I have already raised?

4:55 p.m.

President, Privacy and Access Council of Canada

Sharon Polsky

On privacy legislation, we all have a right to privacy without an age limit, but when it comes to children, we already have children's information being gathered surreptitiously and shared with the data broker industry without consent—of their own or their parents'.

4:55 p.m.

Conservative

Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC

Do you believe that's ethically wrong?

4:55 p.m.

President, Privacy and Access Council of Canada

Sharon Polsky

Of course it's ethically wrong. It's reprehensible. It doesn't give parents, guardians or the kids any say. Then they get bombarded with all sorts of...whether it's online ads, bots or negative commentary. We know now that—

4:55 p.m.

Conservative

Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC

Would it be morally wrong?

I'm the parent of three children. I'm in a unique position to do something significant for kids. Would it be morally wrong for me as a legislator if I didn't take severe action or put forward major amendments to this bill to ensure that companies couldn't commercialize the data of children?

4:55 p.m.

President, Privacy and Access Council of Canada

Sharon Polsky

I think you would be failing as a parent. I also have children. I think it's incumbent on all of us, whether we have children or not, to protect the kids. Whatever goes online now, they get to live with for the rest of their lives, and it gets monitored. Yes, it would be an abdication of parental responsibility.

4:55 p.m.

Conservative

Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC

In respect to sensitive information—I'm sorry to cut you off—do you believe it is incumbent to provide not only a fulsome definition of sensitive information but also specific examples so that we do not leave it to regulators or judges to determine what sensitive information is regarding children?

4:55 p.m.

President, Privacy and Access Council of Canada

Sharon Polsky

It's going to be a monumental task to do it, yes. I've never encountered anything where it's been possible to create an exhaustive list—conceptual and categories perhaps. It has to be able to be expanded and reviewed—expanded is necessary—frequently.

4:55 p.m.

Conservative

Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC

What about in this approach? Some of my colleagues have mentioned proposed section 18 of this legislation. I believe the last paragraph in proposed section 18 outlines “any other prescribed activity.” What if I used the language like “any other prescribed activity”, but in respect to limiting companies from using the information of children? It would be a broad section that would provide protection for children so as to avoid any commercialization of data for children that is unnecessary.

4:55 p.m.

President, Privacy and Access Council of Canada

Sharon Polsky

As an idea, sure, but then how do you operationalize and police it? How do you make sure the companies are actually complying with the legislation?

They've done a poor job of complying with 20-year-old privacy laws. What's going to make this any different or any better?