Industry Committee on Nov. 2nd, 2023

[John Lawford]

If you brought a complaint, the business would probably raise that as one of its defences. I would think that it would also rely on proposed subsection 18(2) of the CPPA and say, “That's the way business is done in this business, and good luck with your complaint.” Taking out proposed section 18 completely would be our recommendation.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

You mean all of proposed section 18, not just subsection 18(3).

[John Lawford]

Yes, I mean the whole thing.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Would anyone else like to comment on that particular issue?

Ms. Polsky.

[Sharon Polsky]

Thank you.

Yes, the issue of consent has been a challenge the whole time. Even under PIPEDA and other privacy laws, an organization is not supposed to be able to refuse to provide the good or service just because you refuse to provide consent. However, they all do, and that hasn't been challenged and hasn't been enforced. As you say, with regard to Zoom and all the rest of them, they do collect the information.

We don't have a choice right now. It's all or nothing, a Faustian bargain. If you want to use this website, if you want to get a car loan online, if you want to do anything online, yes, you're supposed to read the privacy policy that Mark Zuckerberg also admitted to Congress even he doesn't read. Therefore, the organizations—that acknowledge that no one reads their privacy policies and that, yet, still collect the personal information without now, admittedly, having received informed consent—are collecting personal information in violation of PIPEDA and the other laws. No one's ever challenged that.

The only way we're going to get around it is to give each one of us a control as to who gets our information and what they're going to do with it. If I say, “Yes, Zoom, you may collect these pieces of information about me, and you will give me a receipt, an automated receipt system, so that I have proof that this is what I consented to,” then I have something to challenge it with. If the companies were held to account.... It's a challenge because most of them are outside of Canada, but other laws do have extraterritorial reach. Perhaps this one could as well, because consent is the foundation of all of this. In the EU also, it's not a whole lot better. That's one that we absolutely have to tighten up.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Most privacy lawyers that I've talked to in my consultation on this—and I've done a lot of consultation on this, contrary to what the minister did—have said that they don't even read the consent requirements that they're asked to do. If privacy lawyers don't do it, how are the rest of us going to survive?

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Perkins.

Mr. Van Bynen, the floor is yours.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

Thank you, Mr. Chair.

I understand the concerns that you have in terms of requiring consent. How are you going to deal with consent fatigue? Is that a risk that you...?

I'll start with Mr. Konikoff.

[Daniel Konikoff]

I personally don't think that consent should be something that we can be fatigued of. I think that consent is an ongoing process and something where, regardless of a service, the more informed you are at the outset before using it.... I recognize that there are challenges in place or that there are hurdles to getting people to actually meaningfully engage with very boring, very stuffy privacy policies. I don't think that it's really something I would conceive in terms of fatigue.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

However, isn't that what's happening now? The complexity of the consent means that people don't read them, but people provide it. It's enabling organizations to deal with their data in any way they wish. It's an offshoot of consent fatigue. How do we get around that? How do we develop, perhaps, plain language consent?

Ms. Polsky, you had a suggestion around providing consent in advance of.... Could you explain that a little further, please?

[Sharon Polsky]

Consent fatigue I don't think is a problem. As you say, people don't read these things, first of all, because the last time I counted.... I do read them sometimes—or often. The last time I counted, for Google and its primary websites, the combined length of the privacy policies was 38 pages. It's a small book. It's bigger than a bedtime book, and it puts you to sleep faster. They're meaningless.

I challenged the Apple privacy policy to the Privacy Commissioner of Canada. He took it up, which was great. They changed some language, and that was wonderful. However, I'm under no illusions. When they change something here, they change something else there. The problem is that the law allows vague language such as “We will collect your personal information from you and about you for reasonable purposes. We are a for-profit business. Anything that improves our bottom line we think is a reasonable purpose.” It needs to be tightened up.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

Thank you.

Mr. Konikoff, in your brief to the committee, you recommended deleting proposed paragraph 18(2)(d) in the consumer privacy protection act, which provides an exception to consent for “any other prescribed activity.”

Conversely, in the brief of the Office of the Privacy Commissioner of Canada on Bill C-27, the Privacy Commissioner recommends amending this provision to require that all prescribed business activities for the purposes of proposed subsection 18(2) be activities necessary to achieve a specific purpose. What do you think of the Privacy Commissioner's recommendation?

[Daniel Konikoff]

This is a great question.

All I know is that by leaving that language in there for any “prescribed activity”, I fear that there's too wide a catch-all. I think the language is frustratingly vague, and I worry that, without any sort of clear definition on what any prescribed activity is, that could be very much ripe for abuse. Whether that means you take that out or you provide some sort of clearer restriction on activities, I feel that there shouldn't be these large carve-outs that allow any prescribed activity to be added later on.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

What value do you place on the requirement for impact assessments?

[Daniel Konikoff]

I think that, if you are using a system that will be gathering some sort of high volume of data, a privacy impact assessment is a good first step in terms of making sure that you're doing the due diligence, getting out ahead of this and assessing potential risks.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

The reality is that the genie is out of the bottle.

We're using Interac. We're using AI, and you're saying, “Slow down and start over again.” What type of a time window, a timeline, would you put on that so that we catch up to—if not get ahead of—where the industry is now?

[Daniel Konikoff]

It's not my job to really put a timeline on anything, nor do I really understand how these processes work. It seems to me that it takes quite a while.

Again, it's not about starting over on the CPPA, I wouldn't say. It's about starting over on AIDA or about separating AIDA—or at least making some sort of decision around what to do with AIDA—which it seems most are in agreement is difficult, with “difficult” being an understatement. I don't know if I can speak exactly to the timeline question.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

I guess my concern is that we're in catch-up now. How are we ever going to catch up or even get ahead of the situation? Legislation seems to be focused on the rearview mirror when we should be looking out the windshield. I think it's important. Where would we get an understanding of what the timelines are to develop the sense of urgency in going forward with at least the AIDA?

[Daniel Konikoff]

With AIDA...? Again, I assume it would have to do with the machinations of government. I assume that it would have to do with sending the bill back. That's within your power, I believe. Matt stated that it's within your power. It is a possibility.

I think it's something that would need more.... Matt is on the screen over there, so that would be something that perhaps.... I don't know if I could speak to timelines.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

Mr. McSorley, it seems that you might have a response there, so let's hear it.

[Tim McSorley]

Yes. One of the things we've noted is that the minister, I believe, has said that, even for the development of regulations, it should take until 2025 to have all the regulations sorted out for AIDA in its current form. If that's the timeline we're looking at with AIDA in its current form, that should give us time to also step back, look at AIDA overall and engage in that reset my colleague has been speaking about.

We agree that we need to be addressing these issues now, but if already in the way that AIDA is currently envisioned it's going to take that time, why not take that time to also engage in broader consultation, do the public consultation that didn't happen before AIDA was introduced and make sure we get it right by then?

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

Thank you.

I must be out of time, Chair.

[The Chair, Liberal, Joël Lightbound]

You are, but I see that Mr. Hatfield wanted to intervene.

You have the floor, Mr. Hatfield.

[Matthew Hatfield]

Thank you.

Speaking to the point of urgency, like I said, our community also feels some urgency, but why is the urgency so much higher in Canada than in other jurisdictions that are looking at AI? Everyone is moving forward, of course, with delineating the risks, the impacts and how to address them appropriately, but the idea that Canada must move before many of our peers doesn't make a lot of sense to me. I don't think it's going to lead to the best possible rules.

I think that, if we're looking at the timeline, at the very least we should be taking the time for a full public consultation. Consultations like that are really how we stress-test legislation and tease out the different types of problems that can occur. It's a really critical step to improving the final product. We've seen it work with other legislation. It's done on most legislation. I don't see any good reason why we skipped it here.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Mr. Savard‑Tremblay, the floor is yours.