Industry Committee on Nov. 23rd, 2023

[Antoine Guilmain]

It would be to the extent that we are adding sufficient triggers based on the types of information.

These questions were raised as part of law 25. Clearly, the question was, what do we do with a company that...? Let's say a convenience store in La Tuque has some personal information. What do we do with this? The fact is that the convenience store in La Tuque potentially will have non-sensitive personal information. As such, it should not potentially need to have a privacy officer. That makes sense.

However, let's say we have a growing company with 20 people building a very interesting AI model with biometric data or health information. Then I think it would make sense to potentially have some obligation.

Again, this needs to be proportional. I want to give my opinion. I don't think that the number of employees makes sense. Even the revenue is not a good threshold, from my perspective.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

That convenience store is in Minister François‑Philippe Champagne's riding.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Would other witnesses like to weigh in?

Go ahead, Mr. Goldfarb.

[Prof. Avi Goldfarb]

Creating thresholds based on the number of employees creates incentives for businesses to stay small. While there is a desire to have these additional burdens on businesses, we have to recognize that there is a trade-off if doing so depends on the number of employees, because what you're telling businesses is that you don't want them to grow.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Arbuckle, do you have anything to add?

[Luk Arbuckle]

I am very supportive of all the comments that have been made. We had this debate when I was at the OPC. We did a public consultation, and the question came up about an AI start-up processing terabytes of data. It's not about the size; it's about the amount of data and the kind of data.

To your earlier question as well, I'll just add to some of the comments I made earlier about consent exceptions. I think there is an opportunity to align more closely with the GDPR in the sense of making it available to a broader range of organizations—small, large, etc.

When we're dealing with health data, for example—and I've seen this while working across Canada—we have some small, vulnerable population groups, and they can't anonymize that information with such a small population, so how do we bring that data together? How do we bring health care data together? It's partly through some of these current provisions where there is de-identification. We take out the person's name and we put in a pseudonym, but we still link and then produce really interesting, important statistics.

That's the one thing I wanted to bring forward.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Beauvais, go ahead.

[Michael Beauvais]

The point about record-keeping obligations is interesting. To my knowledge, the only olive branch the GDPR hands small and medium-sized enterprises is indeed concerning their record-keeping obligations.

I would note that in the case of a children's code, which Ms. Gordon and I have spoken about, that can actually be very useful for helping businesses, because it provides them, in a way, with a starter manual for thinking through how they should design their products and services that are directed to children. You can raise protections while also being clear and helping businesses in terms of compliance.

[The Chair, Liberal, Joël Lightbound]

Thank you.

Mr. Turnbull, the floor is yours.

[Ryan Turnbull, Liberal, Whitby, ON]

That's wonderful, Chair, and what a nice surprise it is to have a meeting with such great witnesses and without the Conservatives moving a motion to disrupt the meeting.

It's really nice that we get to have you here today.

Mr. Goldfarb, I'll start with you.

I know you mentioned an overly broad definition of AI and you cited some examples, such as regression analysis and some others, that might be captured within the definition of AI currently. I'm wondering how you might narrow the definition. I'm not sure if you have specific suggestions on wording or amendments, but I'd be interested in hearing your thoughts on that.

[Prof. Avi Goldfarb]

Absolutely.

In my speaking notes, I have a footnote, so I'll just read that: “the use of a genetic algorithm, a neural network, machine learning or another AI technique in order to generate content or make decisions”.

The current definition is about any prediction model—and an average or a regression is a prediction model. The definition of an AI technique will evolve over time. What the use of “another AI technique” does is allow for the flexibility of technology to change over time, but it doesn't start regulating statistical technologies that have been around for centuries.

[Ryan Turnbull, Liberal, Whitby, ON]

Okay. Thank you.

I know we've also had a running theme here about perhaps the compliance burden being fairly high on SMEs.

Mr. Goldfarb, you talked about a trade-off or trade-offs—I think it was in the plural. You said that privacy is not free but Canadians care about it. I think many of us probably agree with those sentiments.

What I want to understand is how we can reduce that burden without going too far. I've been thinking about this as a balancing act—as many pieces of legislation are—between the interests of different groups. There are some people who say that the fundamental right to privacy should supervene everything, but it seems as though we could go a little too far down that road and really stifle innovation and also cause undue compliance burden on small and medium-sized enterprises.

I know you spoke to that. I wonder if you could make any suggestions as to how to reduce that burden specifically.

[Prof. Avi Goldfarb]

My starting point is that I think this legislation already is at a good starting point. Where we are right now is good. My concern about the trade-offs would be if we're adding additional things.

That said, there are two pieces that I think are particularly important. The first one is some recognition by the commissioner of the burden on small and start-up businesses. Especially, right now, the cost is borne by the person audited, even if the commissioner finds nothing. That strikes me as very risky. If we have a commissioner who decides, for whatever reason, that a particular company, especially a small company or a start-up, deserves an audit and they go through that process, for the start-ups that work with the Creative Destruction Lab, that may very well kill the company. Some reasonable expenses, in my view, should be covered by the commissioner or by the government when the audit shows no evidence of a contradiction of proposed sections 6 to 12.

[Ryan Turnbull, Liberal, Whitby, ON]

Okay. That's interesting. I hadn't thought of that before, but I can see your point that the risk of being audited or actually being audited, when it's proven later to be not initially warranted, could be very costly if the burden is on the small and medium-sized enterprises. I get that.

Mr. Guilmain, you also mentioned this as a sort of running theme in your opening remarks. You said industry was ill-prepared. You even said that the implementation time should be up to three years. I'm wondering what your thoughts are on how we get the balance right but also reduce the burden. I wonder if you have any more thoughts that you haven't been able to share on the trade-offs there.

[Antoine Guilmain]

Yes. I think there are two sub-aspects from my perspective.

The first aspect is the transition period. I think we should not undermine the fact that, even though there are already processes in place with PIPEDA and potentially with law 25, it does take time to have something that is meaningful.

I'm a lawyer, so I wish I could tell you that it's only a question of the papering aspect and just giving some policies and moving on. The fact is that privacy is much more than only legal professionals. I think there's an understanding internally in any organization to understand what is going on in terms of data flows and what we do to protect the information we have.

That's the reason why I tend to think that 36 months is the bare minimum. As a matter of fact, when we look around the world, that's what we are seeing. We saw with law 25 that 24 months was not sufficient. At the moment, companies are struggling very much to comply even with law 25, most of which came into force.

On the second aspect of your question, regarding what we can change, I will give you a simple example. If we go to proposed section 8 of the CPPA, it says, “An organization must designate one or more individuals to be responsible for matters related to its obligations under this Act.” I'll go back to my example of the convenience store in La Tuque. They have very little personal information. Their first question when they come to me would be, “Whom do I appoint? Who is my privacy officer?”

I think this is where it is problematic. It's not based on the size of the company; it's more a question of the volume and sensitivity of the information, the good news being that this threshold is present in Bill C-27 in some disposition. In particular, when I look at the privacy management program in proposed section 9, there is a caveat: depending on the “volume and sensitivity” of the information. I think the key aspect would be just to look at those absolute requirements and say, do we have a threshold based on the volume and sensitivity of the information? I think this could be a good exercise in the full version of the CPPA at least.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you for that. That's great.

Mr. Arbuckle, I have a question for you, if I still have time.

Following up on my colleague Mr. Sorbara's comments, which I thought were quite good, in terms of the reasonableness component on anonymized data that you were talking about, what I want to understand better is what's at stake. I wonder if you could provide an example where the health outcomes would actually be potentially compromised.

I think what you implied to me was that if you were adding that reasonableness component to the clauses around anonymized data in the bill, you would in fact allow for that contextualization and perhaps a strong protected environment, in which case you could use that data for purposes that are beneficial. You spoke to health outcomes. Could you give us an example to illustrate?

[Luk Arbuckle]

Sure. We've even seen it in other jurisdictions. Basically, the best example is probably the one of small populations. When you want to bring data together and produce.... Basically, what is anonymization? It's producing statistics. We've heard means, aggregates, averages and stuff. That's essentially what we want to do when we talk about anonymization.

If we make the threshold such that it's a zero risk, and if I have 100 people.... If I take the average age of everyone in this room, you will say, “Well, it's not anonymized enough”, but who is going to be able to identify me from the average age in this room? That's the risk. You're going so far and you're saying, “Well, 100 people are not enough. We have to go to 1,000.” Suddenly, you cannot generate the statistics that we currently generate for things like.... In our submission, we included opioids and mental health. These are examples where it would be very hard to create the granular data to see trends over time in different age groups and in different provinces.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you very much for that exchange. I found it very valuable.

Mr. Chair, I think I'm probably out of time.

[The Chair, Liberal, Joël Lightbound]

Yes.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you very much.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Monsieur Lemire, go ahead.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

My question is for Prof. Goldfarb.

In recent weeks, some members of the Bloc Québécois have heard concerns from creators who think that the future artificial intelligence and data act, or AIDA, won't adequately protect their copyright. This issue is even more important in Quebec, where the arts, music and literature are at the heart of cultural and linguistic vitality.

What specific amendments could be made to the proposed AIDA to strengthen the protection of creators' copyright, particularly in a context where cultural and linguistic preservation is a priority?

[Prof. Avi Goldfarb]

From my read of the bill right now, it is not addressing AI and copyright.

I think there are important trade-offs to recognize in thinking through this. On the one hand, it's very important that artists and other people who create work get compensated for it. It is also important that we recognize that there has to be some aspect of their use.... When we, ourselves, read a document and then write something two or three years later, that document might somehow be in the back of our mind as we're drafting it up. We might cite that original person, or we may not, but we don't owe that person funds for copyright.

The first response is that, from my understanding, this bill does not address that. There are reasons to think that clarity will be good. Wherever we land, with a lack of clarity, it is going to be difficult for businesses to build AI systems, and it's going to be difficult for copyright owners to get compensated for their work. Clarity is good. As I understand it, it's not in this bill.

Second, I think it's important to recognize that some of the ways in which copyrighted work is input as data into the AI systems are very clearly related to the value of the copyright. If you ask it to write a song in the style of The Tragically Hip, it will. That's the style of The Tragically Hip, and that seems related to The Tragically Hip copyright. In contrast, if you ask it to create something that rhymes and somehow, in the dataset, there is some copyrighted work that rhymes, thinking through how every single copyright owner who's written something that rhymes should be compensated will be quite a nightmare.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Taking it a step further, to what extent will insufficient copyright protection affect cultural creativity? How can we learn from international best practices to mitigate potential negative impacts?

[Prof. Avi Goldfarb]

I was at a recent poetry reading, of all things, at an AI conference. The poet used AI to develop her poetry, and it was amazing and fascinating and a pleasure to listen to. That's creativity enabled by AI. That poet got to copyright her work. The other poems that were inputs into the overall database at that point did not get to benefit from their copyright.

The reason I tell that story is to recognize that for cultural creativity, going forward, there are reasons to want a very open use of these AI systems. There's incredible creativity coming out of these AI systems—not the [Inaudible—Editor], to be clear. One of the things I love about the bill itself is that it's so clear that humans make decisions and not machines, so the creativity is human creativity enabled by AI systems.

In the process, though, we need to make sure that when copyright is violated in a particular way—for example, it's clear that you were trying to mimic a particular artist's style—it gets protected.