Evidence of meeting #98 for Industry, Science and Technology in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was data.
A recording is available from Parliament.
Conservative
Liberal
Francesco Sorbara Liberal Vaughan—Woodbridge, ON
Thank you, Chair.
Thank you to all the witnesses for their testimony on a very important piece of legislation.
If I may, I'll go to Mr. Goldfarb for the first question.
Mr. Goldfarb, you mentioned in your remarks that “Canada is a leader in AI research” and that AI and data-focused tools are promising for economic growth but obviously must be utilized. In that vein, you published an article in September 2023 called “The Economics of Digital Privacy”. I was wondering if you could elaborate in terms of how Bill C-27 would impact innovation, and thus productivity, and thus our standard of living through Canadian businesses and the economy, please.
Prof. Avi Goldfarb
Thank you for the question.
There are two key forces at play here. The first force is that any time you regulate companies and start-ups, especially small businesses, they're going to require lawyers in order to do business. That's going to slow down what they're able to do. That's on the one side. On the other side, if there is no legislation in place, then potential customers of those companies aren't going to trust the companies. Even though the need to get legal advice—apologies to the lawyers in the room—is a real barrier for small businesses and start-ups, you do need legislation so that people can trust the companies they interact with.
In my view, this bill balances those two very well, with some minor exceptions that I've mentioned. It protects against the most severe privacy harms, so that we'll have more trust in what organizations do with data. That will, in turn.... On the set of regulations as described, yes, it is a bill that runs dozens and dozens of pages—you'll need expertise—but it is not so onerous that I would expect that the small businesses and start-ups that have a big opportunity with AI will have to shut it down.
In my view, on balance, this will position Canada well going forward for our ability to commercialize AI.
Liberal
Francesco Sorbara Liberal Vaughan—Woodbridge, ON
Going down that vein, in terms of comparing pieces of legislation in different jurisdictions, how would you characterize the framework in Europe—the GDPR—versus what's contained in Bill C-27 with relevance to the impact on innovation and the economy?
Prof. Avi Goldfarb
We have plenty of evidence that the GDPR, when and where enforced, reduced innovation, hurt the European software industry relative to the American software industry, and helped the largest companies, particularly in advertising technology, do better and better. There were real costs to the protection of privacy that happened through the GDPR.
When I look at how this bill was drafted, I think that in protecting privacy and thinking about and addressing the potential harms of AI, to me it's clear that it was drafted with an eye towards the need for start-ups and small businesses to compete on a level playing field with the largest companies. In my view, this bill is more innovation-friendly, particularly for small businesses and start-ups, compared to the GDPR.
Liberal
Francesco Sorbara Liberal Vaughan—Woodbridge, ON
Okay. That's good to hear, in terms of how the law impacts innovation and productivity, because we know that innovation is a very large piece of what AI is and what impact it would have on our economy and standard of living in our daily way of life.
Luk, my understanding is that you're a private sector firm. Is that correct? You're a privacy expert. When I jotted down a few notes from your presentation or your discussion, one thing you commented on was the “reasonableness” approach and a realistic framework of risk when it comes to anonymous information. Can you elaborate on that to non-privacy and non-AI experts such as ourselves, who are grasping the information that's put in front of us in this bill, and on how important this is to everyday Canadians going forward, realistically? Can you elaborate on what you meant there and contextualize it, please?
Chief Methodologist and Privacy Officer, IQVIA Solutions Canada Inc.
Yes. The word “contextual” is important here, as well, because that's kind of how we want to look at anonymization. We want to look at where we are using this information.
When Statistics Canada produces statistics or data that they make publicly available, the risks are very high because it's on the Internet. Anyone can access it. They also take data and put it in a research data centre. It's disconnected from the Internet. You have controls according to who has access to the data, how they can use the data and what they can come in or out of the environment with. The risks are much lower, so it's contextual in that sense.
The idea of a reasonableness standard is bringing that contextual piece to it. When we look at international standards, for example, they're primarily very scientifically driven by risks, and risks are never zero. Therefore, by looking at it in this contextual way, we can manage the threats and use other tools besides just aggregating and creating means, as was mentioned earlier. We can do things that are a little more sophisticated, and we can have strong environments that control that information.
Liberal
Francesco Sorbara Liberal Vaughan—Woodbridge, ON
Prior to entering this privileged and honoured job that we get to do, I worked in the private sector for a very long time, for a very large organization in the financial services industry. How would you explain your company's use and compliance with PIPEDA?
Chief Methodologist and Privacy Officer, IQVIA Solutions Canada Inc.
The technology we use, the sophistication of it, is compliant in the sense that we look at the best practices that exist. We look at international standards. We look at guidance that is being produced, and we ensure that the anonymization we do meets those standards.
We have guidance in Ontario, for example. We have the law itself, for example, in Quebec. We have a variety of jurisprudence, which is not in my area, of course. We look at the best practices in terms of technology. We monitor the literature and the landscape of what's happening, and we modify accordingly.
Liberal
Francesco Sorbara Liberal Vaughan—Woodbridge, ON
How much time do I have? Is that it? Okay.
Thank you very much.
Liberal
The Chair Liberal Joël Lightbound
We might have some time at the end.
Mr. Lemire, the floor is now yours.
Bloc
Sébastien Lemire Bloc Abitibi—Témiscamingue, QC
Thank you, Mr. Chair.
My thanks to all the witnesses. I think we're having a very high-quality meeting today, and I'm very grateful to them.
Mr. Guilmain, I'll start with you. I'm going to continue in the same vein as one of my colleague Mr. Sorbara's questions. According to a letter published on the committee's website, although the minister assures that the Quebec legislation will prevail in the province, Jim Balsillie, in particular, expresses concerns that, if Bill C‑27 sets standards that are lower than those of Quebec's Bill 25, it could hinder innovation and jeopardize investments in the Quebec economy.
With that in mind, how do you assess the potential impact of Bill C‑27 on Quebec's economic landscape, particularly on investment and innovation?
Counsel and Co-Leader, National Cyber Security and Data Protection Practice Group, Gowling WLG, As an Individual
At the moment, conceptually, Bill C‑27 is quite compatible with Bill 25. I would even say that, in many respects, Bill 25 is stricter than Bill C‑27. I'll go further than that: Bill 25 is one of the strictest laws in the world. That has to be recognized.
In my practice, I work with international clients, whether they are based in the United States, Europe or Latin America, and today, they look at Bill 25 and say that it's really one of the most complicated laws to implement and that it's difficult to comply with it. That's not a good thing.
My position today, quite frankly, is that the two pieces of legislation are compatible. However, I think there are lessons to be learned from Bill 25. I took the liberty of quoting the European Union's General Data Protection Regulation, the GDPR, and I think that's a very interesting model for Bill C‑27 to look at. That's really my position.
There are some very good things in Bill C‑27. It should be noted that, from a legislative standpoint, it makes a very different change. Bill 25 amended existing legislation by patching things up a little. We tried to add an act dating back to 1994. The beauty of Bill C‑27 is that it's unified. There really is a collective understanding.
So my comment on this is to say that looking at Bill 25 as a yardstick may not be the best approach, in my humble opinion.
Bloc
Sébastien Lemire Bloc Abitibi—Témiscamingue, QC
Thank you for your answer.
In that case, what amendments would it be worthwhile to make to Bill C‑27 to ensure better compatibility?
I'm particularly sensitive to the need to have an environment conducive to innovation and investment. In the current context, is there a risk of establishing standards that could undermine investment and innovation in Quebec?
Counsel and Co-Leader, National Cyber Security and Data Protection Practice Group, Gowling WLG, As an Individual
There's a fairly fundamental difference. As you know, when it comes to privacy, the notion of consent is central. It's all about consent. We're talking about either express consent implicitly or an exception to consent. That's how Bill C‑27, the current federal act and the Quebec act are built.
Currently, Quebec's approach is very different from the rest of Canada. In fact, it decided to enshrine in law that, when it comes to the collection of personal information, consent isn't always required, provided that the reasons for collecting, using or communicating personal information are disclosed. This was recently confirmed in the guidelines of the Commission d'accès à l'information du Québec.
What does that mean in concrete terms? It's very theoretical, but it's not that theoretical. When you visit a website, you are “attacked” by various methods of consent. That's what we want to impose on children. As adults, our ability to concentrate is very limited. Personally, I have a full-time interest in this, and I don't read everything.
Quebec has decided to take a different approach: we don't force people to give express consent, to click, we just give them the information, and then they can continue with the process. This aspect of transparency is unique to Quebec.
At the moment, the federal legislation, as drafted, seems to indicate that a positive gesture should always be made in certain cases. I think that's a pretty significant difference. Again, not a bad thing. In fact, we're a different approach to the problem. We're providing a little more transparency, a little more control, instead of forcing people to consent in an almost fictitious way.
Bloc
Sébastien Lemire Bloc Abitibi—Témiscamingue, QC
I'd like to ask you some brief questions about the delays in passing Bill C‑27, since you've opened the door in that regard. Is there an urgency to act? What would the consequences of that be, if we took our time, in a parliamentary context like ours? What do you think about the government's delay in enforcing the act?
Counsel and Co-Leader, National Cyber Security and Data Protection Practice Group, Gowling WLG, As an Individual
I'd first like to mention that our federal legislation, the Personal Information Protection and Electronic Documents Act, PIPEDA, is a quality piece of legislation. I wouldn't say that there's an urgent need to act, but that's a very personal opinion. There are fairly broad concepts in PIPEDA that already allow companies to do very good things. We aren't in a vacuum at the moment.
That said, Bill C‑27 is very ambitious. I'm talking about the part that deals with the protection of personal information. We shouldn't underestimate the time it will take to adjust the processes. Let's not forget that companies had to grapple with Quebec's Bill 25 a few months ago and complied with it last September. It was a real in-house effort.
I think there's an interest in avoiding a duplication of resources, at the risk of creating a kind of fatigue on the part of companies with regard to requirements. Businesses will no longer understand the message being sent to them. I think it's important to keep in mind the significant transition period.
I don't think there's an urgent need to act, but that's my very personal opinion.
Bloc
Counsel and Co-Leader, National Cyber Security and Data Protection Practice Group, Gowling WLG, As an Individual
In terms of aligning with the European Union, I must say that it will require an analysis that may take years. Japan recently received a suitability decision and is considered a good country for the transfer of personal information. This is the result of years of work by the European Commission.
I think Bill C‑27 is a very good bill in terms of complying with European standards, in this case the European Union's General Data Protection Regulation. There are a lot of “Canadianized” concepts, if I may say so. It's worded a little differently, particularly when it comes to sensitive data. I still think that Bill C‑27 is a good bill in that regard, apart from certain aspects on anonymization and the legal basis for handling personal information, as I mentioned.
Brian Masse NDP Windsor West, ON
Thank you to the witnesses for being here.
Maybe I'll go across the board here.
For the Americans, Biden's executive order gives the administration, from the top down, more control and ability. Basically, it removes Congress, in many respects, from making decisions, and the executive order is almost like an order in council here. We were fortunate to be in Washington, and when our analyst was there, she clarified that as well. It was an interesting point that we didn't realize—the extent to which it has been removed from the halls of Congress and, to some degree, the Senate.
I'm wondering what your position is with regard to how we deal with the United States' executive order coming from the administration, as it really will be a top-down approach that they're going to have. How do we have any type of consistency with that in our country as we go through these hearings here?
Ms. Gordon, I don't know if you want to start, and then we'll move across the table here.
