Industry Committee on Nov. 2nd, 2023

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Mr. Généreux, you have the floor.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Thank you, Mr. Chair.

I want to apologize. I had to go give a speech in the House, so I may have missed some things. I'd like to avoid repeating anything that may have already been asked in my absence. That said, Mr. Lawford and Ms. Sai, I'd like to ask you some questions to follow up on Mr. Gaheer's question about the tribunal that the bill aims to create.

I have great respect for Mr. Balsillie, whom the committee received on Tuesday, and for Mr. Geist, who appeared last week. I digress to say that, so far, no one has spoken positively about this bill. I think we have a serious problem.

Moreover, Mr. Lawford and Ms. Sai, you're saying that we should remove the provisions to create a tribunal from the bill because that could slow down the process should any lawsuits be filed after the bill comes into force.

Could you elaborate on that?

[John Lawford]

I will answer first and Ms. Sai can round out my answer.

Under the current regime, a decision is made directly by the Privacy Commissioner of Canada. The process takes about a year, in the case of major investigations.

Based solely on the experience of the Competition Tribunal, I estimate that this added step will extend the process by a year to a year and a half. In addition, it will benefit companies that appeal against a Commissioner's decision. I see no benefit to consumers, who are typically the ones who benefit from the Commissioner's decisions.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Earlier, Ms. Sai, you made a comparison with rocket fuel, but I forgot the rest of the sentence. It was something about pouring gasoline on the fire. I don't remember exactly what you were referring to, but I think it was clause 39 as proposed in the bill.

[Yuka Sai]

Are you referring to proposed section 39, which is the “Socially beneficial purposes”?

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Yes.

[Yuka Sai]

When I refer to proposed section 39, what it really serves to do is degrade public transparency and and public trust in our public institutions because of two things.

First, it requires businesses to de-identify personal information before transfer to a public institution. That means they don't have to adhere to knowledge or consent requirements as long as they de-identify. The other thing proposed section 39 does is allow the minister to prescribe additional public entities and new socially beneficial purposes with which to engage this exception to knowledge or consent. This facilitates unwarranted secrecy in the way that public institutions obtain personal information from the private sector to use in the policy decisions that affect us all.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Thank you very much.

I'd now like to address Mr. Hatfield of OpenMedia.

At the beginning of your presentation, you said that AI is going to have an even greater impact on people's lives than the advent of the Internet some 30 years ago. What exactly did you mean by that?

[Matthew Hatfield]

We're in a funny space where no one is quite sure exactly how generative AI is going to play out. There are huge disagreements around that. When I shared that view, that was the view of about a third of our community, who said the impact was going to be comparable to or bigger than the Internet.

About 80% of our community thought it would be bigger than smart phones. As I represent OpenMedia, I'm somewhere in between bigger than smart phones and the size of the Internet. That could be untrue, but I think we need to prepare for a range of possibilities, which could include, frankly, generative AI largely replacing the Internet as we know it and most information coming through working up some kind of AI that speaks to us in the language we speak.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Mr. Sorbara, you have the floor.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you, Chair.

Welcome, witnesses.

I apologize for not being here at the beginning of the committee meeting. Nonetheless, I do have a few questions.

I can start off with Sam from TMU. You have a view, I would say, in terms of the artificial intelligence and data act, in terms of what amendments you could or would probably propose. Also, perhaps you can comment, please, on your view of the act in general.

[Sam Andrey]

Sure. I think the bill needs lots of amendments and improvements. I think some have been tabled by the minister already, and several are noteworthy improvements from the current version.

Maybe I'll just focus some comments on things I haven't yet raised.

I think the current model is really focused a lot on audits that organizations will potentially do themselves to determine the risks and harms. AI auditing is not yet a codified practice. It's not even really clear what field of expertise should be doing these audits. Is it computer scientists? Is it accountants? Is it lawyers? This is going to take time to develop, and it has to be accompanied by robust standards.

As that happens, the bill as it stands doesn't have a complaint mechanism. It's silent on how the minister will establish grounds to believe an investigation is required. There are no whistle-blower protections for people who bring things forward. There's no ability to do pre-emptive audits. I think my biggest challenge with the act is in its regulatory model, and I do think that those pieces can be fixed.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you.

I'll go over to the Privacy and Access Council of Canada. As this committee meeting is going on today, in Europe there has been a large AI meeting. All the leaders were there—the U.K. leader, the Italian leader and so forth.

I want to ask your thoughts in terms of the artificial intelligence act. I think there was a document dated April 14, 2023, with regard to the EU becoming likely the de facto global standard for general-purpose generative AI intelligence systems. I may be very humble about this, but with the speed at which AI and other forms of new technologies are taking place, I don't know how many people actually understand them.

We were over in Europe several months ago as chairs of the Canada-Europe Parliamentary Association. We had some folks actually from Montreal there, who gave us presentations.

It's very complicated and so forth, but I would like to hear your thoughts in terms of the EU's proposed AI act and where that will take not only the EU but the world, because it seems there is some “first mover” going on, if I can use that term.

[Sharon Polsky]

I think each country wants to be the first. As was questioned earlier, is that the right choice? Canada is marching forward and pushing this through, but to what benefit and, more concerning, to what harm?

When it comes to the EU and the U.K., yes, they've given thought and lots of consultation, but I think it's important to not consider these pieces of legislation in isolation, because on one hand we have robust AI regulations coming out of the same country that just passed the euphemistically named “Online Safety Act” that requires all content to be monitored, including yours, because the Internet is global.

How do we protect anything when AI is behind the scenes? AI is used in these buildings, in airports and in shopping centres. It's everywhere already.

Yes, they have a jump on Canada. Is it the right direction? It's certainly better than what we have in Bill C-27. There is no disagreement on that, whether from today's meetings or from many of your previous witnesses. We can look to our European counterparts. They are on a better path. That's about as generous as I can get right now.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you.

That's it for me, Chair.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Mr. Savard‑Tremblay, you have the floor.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Thank you, Mr. Chair.

My next question is for Mr. Lawford.

During certain testimonies and meetings with people in the industry, we heard a great deal of unease about the lack of detail in part 3 of Bill C‑27. I Am talking about the part that enacts the Artificial Intelligence and Data Act, as well as the criminal liability it imposes on companies using high-impact AI systems.

To what extent do you think all this will need to be clarified, if we are to promote greater trust and ease among businesses, and SMEs in particular, while maintaining rigorous protection provisions? Where is the balance?

[John Lawford]

I have a problem with the fact that the bill distinguishes between large companies and small and medium-sized companies, because, in the case of the most intrusive systems, I doubt that the size of the company matters. Let's say someone opens a new gym equipped with several tracking capabilities, for example. Whether it's a very small, very innovative company or a large one like GoodLife Fitness, what difference would it make to the individual whose data is being collected in order to establish their profile and locate them?

I believe that the Privacy Commissioner is the best person to assess the need to set a higher fine for certain companies, and I'm certain that the appropriate amount will be chosen for each particular case. In addition, the court will be able to determine whether this is too great a burden for small and medium-sized businesses.

I don't know if I've answered your question.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

In 30 seconds, I won't have time to formulate another one, so thank you.

[John Lawford]

All right, thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you very much, Mr. Savard-Tremblay.

It would normally be Mr. Masse's turn, but he had to leave a little early. He agreed to give me his time. So, I'm going to take this opportunity to ask you a few questions, too.

I'll just echo some of the concerns my colleague Mr. Van Bynen has raised about consent fatigue and also what Mr. Perkins talked about when it comes to the Zoom contract, where the terms can be changed at the discretion of the organization.

In my mind, consent, when it comes to online activities, is a bit overrated, because there is such a big imbalance in power between the user and the organization. We cannot say that there is a meeting of the minds when privacy lawyers don't even bother to read the terms. I'm a lawyer. I haven't practised in a while, but I don't read the terms, and we need to use these apps in our day-to-day lives.

This is what, to me, the role of the legislator is: to strike that balance for consumers, kind of like in a landlord and tenant situation, where the terms are very clearly defined. I gather from your interventions that this balance has not been struck in this bill. What would be absolutely essential for us to strike that balance?

Go ahead, Mr. Hatfield.

[Matthew Hatfield]

I'm glad you came back to consent fatigue, because many of us feel consent fatigue much of the time, but not always. This is where ongoing consent is very important. It's having the power to have a simple, easy-to-understand dashboard that essentially has a privacy slider from here to there, and either I can come in before I start using the service and say, “I want to be here” or—and this is crucial—I can come back after having used the service for a period of time and say, “I have changed my mind. I had consent fatigue when I first signed up. I ended up clicking through something I shouldn't have, but now I have thought about it, I have the presence of mind and I no longer want to be on the most permissive side of this.”

The ability to revoke my consent or at least restrict the way my data is being used in a way that, to date, I haven't been able to is very important as well.

[The Chair, Liberal, Joël Lightbound]

Are there any other comments?

Go ahead, Mr. Konikoff.

[Daniel Konikoff]

Thank you. I have a quick comment in this regard.

On the subject of consent fatigue, perhaps that's something that private industry could look to try to combat by coming up with innovative ways to develop more enticing or readable materials that are more informed. I believe that would allow for people to give more informed, more meaningful consent.

I could point to the work of some scholars out of York University, such as Jonathan Obar. He is working on a project to make consent and privacy policies more user-friendly, so he's putting them in terms that users may understand. If it's an app that is predominantly used by teenagers who look at memes, it's folding the language of memes into user consent. Putting consent in the language of the user is one way around that.

[Sharon Polsky]

If I can, I'll add to that. Right now, we already have a problem, because some people say there is consent fatigue, but before you even see the website you've called up, the fact that you have called up that website has been communicated to Facebook through Meta Pixel and hidden devices that you don't have the opportunity to consent to or withhold consent from. It's going on in the background. Even if, as Matt suggested, you get the opportunity to withdraw your consent, that doesn't flow to all of the dozens and hundreds of organizations in the data brokerage industry that are bidding on and exchanging your information. You don't have a direct relationship with them. You have no control.

I think the law needs to put very clear prohibitions on industry to say you're allowed to do certain things, and here is a list of the types—not specific actions—of things thou shalt not do, including dark patterns—where the consent is, “No, I don't consent” and it returns “Are you really sure? Do you want to reconsider this?”—or the colours used. A lot of study has been done about this sort of thing. It's manipulative. Whether it's for adults or children, regardless of intelligence, education or competence, it is manipulative. It needs to be banned in Canada as well.