Evidence of meeting #98 for Industry, Science and Technology in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was data.
A recording is available from Parliament.
Bloc
Liberal
The Chair Liberal Joël Lightbound
You're right.
Thank you. I'm lucky to have you as vice-chair, Mr. Lemire, to call me to order.
Mr. Perkins.
November 23rd, 2023 / 5:05 p.m.
Conservative
Rick Perkins Conservative South Shore—St. Margarets, NS
Thank you, Mr. Chair.
This has been fascinating, as has been the testimony on the whole thing.
Dr. Guilmain, you have two Ph.D.s, as I understand it. You've pretty much earned the “Dr.” You have a very impressive background.
You seem to be getting all the popular questions here. I'd like to talk to you about two things. One is the issue of consent, which we have raised before. I've raised this in the committee before with other witnesses—the famous thing that happened with Zoom in the summer. I know from your résumé that you seem to have done some work in the past for Meta.
This is from section 15.2 of Zoom's consent clause on privacy that we all click—and even most lawyers click, too—without actually reading most of it. It says, “You agree that Zoom may modify, delete, and make additions to its guides, statements, policies, and notices, with or without notice to you, and for similar guides, statements, policies, and notices applicable to your use of the Services by posting an updated version on the applicable webpage.”
To me, that doesn't sound like consent. It sounds like it's changing the terms without your consent. Is there anything in this bill that prohibits that practice?
Counsel and Co-Leader, National Cyber Security and Data Protection Practice Group, Gowling WLG, As an Individual
I'm going to emphasize the obvious. I'm here in my personal capacity, to start.
The second aspect is that what you are showing at the moment is the limits of consent. That's what it is. It's essentially showing a big chunk of text and expecting the individual to consent. That's the reason exemptions to consent are interesting, because you will actually focus on the important moment of a data flow. Essentially, if you want an express consent on biometric data, then you're going to ask for consent.
Those kinds of things potentially could have been, in my personal view, captured by the notion of legitimate interest. If the regulator, the OPC, has any questions, then it can knock on the door and ask, “Why are you doing this? Show us the assessment.”
That's the reason why consent, to me, is not necessarily the solution. It's not bad. I think, globally, there's a consensus. Everyone understands consent. We like the notion. I think it sounds good. At the same time, it has limits. If we want meaningful consent, then we should focus on express consent in limited situations. Otherwise, we will spend our time consenting and not meaningfully consenting. I think this is my—
Conservative
Rick Perkins Conservative South Shore—St. Margarets, NS
I'm sorry to interrupt, but I have limited time.
Proposed subsection 15(5) says that implied consent can be used, and you've talked about proposed subsection 18(3). When you pile all those up with proposed section 5, the “Purpose” section, which says that a company's interest is of the same value as an individual's right to the protection of privacy, doesn't that weigh everything in my favour, for me, as a former marketer, to be able to use and to do what my company needs most, over your personal interest?
Counsel and Co-Leader, National Cyber Security and Data Protection Practice Group, Gowling WLG, As an Individual
That's not necessarily the case, because the balance is always in thinking about the rights and interests of the individual. It's not something that you do in a vacuum. These are analyses of proportionality and of necessity. It's a long assessment. It's not a two-pager. I think it's not only that.
Conservative
Rick Perkins Conservative South Shore—St. Margarets, NS
Thank you, Dr. Guilmain.
Mr. Chair, I'd like to propose a motion, because I was poked by the bear. I wasn't going to do this, but I'll do it now, anyway.
I move that, pursuant to the request for documents passed by the committee on November 21, 2023, the committee order the Minister of Innovation, Science and Economic Development to produce unredacted copies of the Stellantis-LGES battery plant contracts to members of the committee in both official languages—in other words, get it translated—by Tuesday, November 28; further, that the committee pause the study of Bill C-27 until the contracts have been circulated.
The reason, Mr. Chair, for doing so is that we all know the government has hired, over the last few years, another hundred thousand officials. Surely, they can get it translated if the contracts weren't presented in both official languages. It surprises me that the government would not have contracts in both official languages before signing them.
I request that all efforts be made on this critical issue, where such a large government subsidy is involved and where there are such conflicting public reports about what's going on, so that we get access, as committee members, to the terms outlined—as MP Turnbull amended and as the Liberals voted for, ultimately—in the motion at our last meeting. Get the French quickly. It should not take some undefined period of time for the government to present it. We can't get on with the urgent nature of what we passed at the last meeting without, justifiably, a French version and an English version of the contracts.
I think the government should treat this with the most expediency and put all the resources it can into addressing the needs of this committee. I'm asking that they produce the translated documents very quickly. Once we get them, we'll pause for the day or two we need to look at the contracts. This isn't an indefinite pause. It's to give us the opportunity. Let's say we had them by Thursday. Instead of Thursday's meeting, we would have the day on Thursday to take a look at the contracts, if that's the way it works out.
Thank you, Mr. Chair.
Liberal
The Chair Liberal Joël Lightbound
Procedurally, Mr. Perkins, I understand you're giving notice of the motion. You're not tabling it, because, if notice was not given, to table-drop a motion, it has to be on the topic discussed. We're on Bill C-27.
I understand there's one sentence at the end that would pause Bill C-27. It's not precisely on the topic. I'm tempted to say this cannot be discussed right now, because notice was not given, but I'll hear you out, Mr. Perkins, on that.
Conservative
Rick Perkins Conservative South Shore—St. Margarets, NS
I appreciate that, but we are studying Bill C-27 now. That is the discussion we're having. We can ask any question we want of witnesses on Bill C-27, a very large bill. This is about the relationship of two studies and Bill C-27. I could point you to the procedures book—“the big green book”, as we all call it—and page 1061. The reference there allows us to reference the topic at hand that we're discussing. It would be in order.
Perhaps the clerk could take a look at that page. I know she knows this book inside out, because I've talked to her a lot about it in the past. She's very knowledgeable about it.
If you'd like, I could take a minute, or I could read it in. I don't think that's necessary, probably, since the clerk has it. It's on page 1061.
Liberal
The Chair Liberal Joël Lightbound
I'll take a couple of minutes to read it myself, in order to determine whether this motion is receivable as a motion that has been table-dropped on the floor like this.
I'll briefly suspend. I apologize to the witnesses.
Liberal
The Chair Liberal Joël Lightbound
Order, colleagues. We will resume the discussion.
We're on the motion that was just tabled by Mr. Perkins.
After considering Mr. Perkins' arguments and consulting with the clerk as well, I'll note that our routine motions—which the committee voted on at the beginning of this legislature and which were agreed on by all parties—state clearly, “That a 48-hour notice, interpreted as two nights, be required for any substantive motion to be moved in committee, unless the substantive motion relates directly to business then under consideration”.
I don't think the motion before the committee right now, which Mr. Perkins submitted, substantively deals with the matter at hand, which is Bill C-27. I understand, then, that this is notice given for this motion, and it will be receivable at our next committee meeting on Tuesday.
On that note, Mr. Perkins, you still have a minute for our witnesses. Otherwise, we can move to our next speaker.
Conservative
Rick Perkins Conservative South Shore—St. Margarets, NS
Thank you, Mr. Chair.
Thank you, witnesses.
Mr. Goldfarb, I don't know if you're related to that famous Goldfarb pollster or not. You are. Okay. He was one of the innovators of polling in Canada. I don't know if he's your father, but he did great work.
I come at this as a marketing person when I look through this, and I know how much my colleagues—I won't say me—would push the envelope on analyzing data. This act is a brand new act—I'm talking about the privacy part—that would replace everything. The hole that's there in the buildup—as I mentioned to Dr. Guilmain—is from the “Purpose” section through to proposed section 15, “Consent”, and proposed subsection 18(3). I didn't mention proposed section 35, which allows the movement of data without a person's consent. It doesn't say it's limited to academic purposes, as PIPEDA does now.
Doesn't that actually create a big hole that marketers can exploit, combined with these weak consent provisions that are still there, and allow companies to still utilize your data, change the terms of reference, create new data uses without your permission and even—in the case of proposed subsection 18(3)—harm you? They can actually use it to harm you.
Does it not do that?
Prof. Avi Goldfarb
I'll be a little careful. I'm not a lawyer. I'm an economist. In my view, as an economist reading this, the harms of data flows are well protected, while at the same time, businesses and other organizations are going to be able to use data in ways that allow them to deliver better products and services to individuals—with the caveat of recognizing that I'm reading it with the eyes of an economist and not a legal scholar.
Conservative
Rick Perkins Conservative South Shore—St. Margarets, NS
Proposed subsection 18(3) says that you can use it even if it harms the individual.
Perhaps I would ask that question of Dr. Guilmain, as well, as a lawyer. It's on the issue of proposed subsection 18(3) allowing for the data use even if it harms the individual. I'll give you a moment to take a look at it.
Counsel and Co-Leader, National Cyber Security and Data Protection Practice Group, Gowling WLG, As an Individual
Would you mind repeating the question?
Conservative
Rick Perkins Conservative South Shore—St. Margarets, NS
It reads, “the organization has a legitimate interest that outweighs any potential adverse effect on the individual resulting from that”. It's harm, basically.
Prof. Avi Goldfarb
Again, in my view, given my expertise as an economist, the explicit recognition of trade-offs is positive, and together with the explicit sentence that this is what somebody would expect if they were interacting with this company, it suggests a careful weighing of the trade-offs between the benefits of data flow and the benefits of privacy.
Conservative
Rick Perkins Conservative South Shore—St. Margarets, NS
Thank you.
Maybe I can add one more caveat to that. I think the caveat that's always in here is “reasonable person”. The question is that there are a lot of people who aren't necessarily at that level in terms of their knowledge of the use of data. I think Europe actually may have a different standard that protects more vulnerable people than that term does.
Counsel and Co-Leader, National Cyber Security and Data Protection Practice Group, Gowling WLG, As an Individual
Maybe I can give you a very simple example regarding cookies. We've all heard about cookies on websites, and 10 years ago cookies were very new, something that people didn't understand. Now, 10 years later—or more like 15 to 20 years later, actually—I think this is something that is well known by reasonable persons. Just to be clear, the fact that it's evolving is not bad. I think our laws are built on a notion like this, that essentially we are making things evolve.
What I see in proposed section 18, to be frank, is the assessment. The assessment makes me feel more comfortable in being able to say that this is rational and it's been explained. It's been detailed, and it's not just somebody saying, “You know what? I think I have a legitimate interest.”
Again, I understand that those are valid concerns. I hear you, but at the same time the world is changing fast. I think we can do tremendous work, and I think Bill C-27 is full of potential, but we need to accept as well that technology is going so fast that those kinds of concepts need to be embedded in the law.
That's my position.
Liberal
The Chair Liberal Joël Lightbound
Monsieur Beauvais, I'll yield the floor to you because you've been patient.
Doctoral Candidate, Faculty of Law, University of Toronto, As an Individual
Thank you.
Mr. Perkins, I think any data protection laws are going to necessarily involve a weighing exercise. This is something that Mr. Goldfarb picked up on too. It's about weighing different interests.
I think that a lot of work could be done in proposed paragraph 18(4)(c) in terms of the prescribed requirements as part of the conditions of precedent, if there are specific concerns there. That's something that maybe the committee can think through quite carefully in terms of fixing specific things or addressing particular concerns regarding vulnerabilities of different users. I would also note that vulnerability is indeed a concept that appears throughout the GDPR, in particular its recitals.
Conservative
Rick Perkins Conservative South Shore—St. Margarets, NS
Are you talking about adding definition to proposed paragraph 18(4)(c) through the act or through regulations?
