Public Safety Committee on March 18th, 2024

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

Okay. Thank you.

I understand the intention. I just think the issue around disclosure of information is covered in other sections in which that would be appropriate, and adding a delay in terms of getting a court order raises concerns, given that what we would potentially be dealing with would be cyber-attacks. I think everyone understands the speed with which we need to address those.

I therefore can't support this as it is, just given that delay. However, I understand the intention.

[The Chair, Liberal, Heath MacDonald]

Thank you.

We'll go to Mr. Shipley, please.

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

Thank you.

Obviously, we want to make sure things are expediently dealt with. I'm just curious, though. I know this is a tough one to give you as a question to answer. With regard to obtaining a court order if necessary, can you give me a timeline on an instance like this that would be pertinent? How long would that take? Is there any idea?

[Andre Arbour]

As you may have surmised in your question, it can be very context-specific. However, another reason why it can be challenging to answer is that it can depend on what the court is dealing with and on broader, contextual factors. It could add days or weeks, depending on the context.

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

All right, thank you.

I know that my friend Mr. Motz has a strong, long-time law background. I'm going to see what he has to say about this. It's not a legal background, but—

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

I'm more practical in my application of the law. That's what it is.

[Doug Shipley, Conservative, Barrie—Springwater—Oro-Medonte, ON]

“Practical” is a good word.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

I'm not theoretical like the lawyers.

This is proposed subsection 15.5(3). It's talking about exceptions.

(3) Information that is designated as confidential my be disclosed, or be permitted to be disclosed, if

(a) the disclosure is authorized or required by law;

(b) the person who designated the information as confidential consents to its disclosure; or

(c) the disclosure is necessary, in the Minister’s opinion, to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption.

What we're doing is replacing (c) with the following:

(c) the disclosure is authorized by an order made under subsection (4).

We're changing proposed paragraph 15.5(3)(c). Unless our numbers are wrong, we're not adding this as a (d). We're replacing proposed paragraph 15.5(3)(c) with this. Is that correct? That's how I understand it.

I don't know where the caution would be, because this is in the event that a disclosure is going to be happening anyway, and we are saying, here are the reasons why disclosure can occur: one, two and three. Is that right? We're not saying that you have to go to court to get an order. Surely the government is not going to order disclosure. The government is going to be ordered to provide the disclosure. Your argument would make sense to me, Mr. Arbour, if we were talking about an active something that has to be disclosed, but we're talking about something that's disclosed after the fact, potentially. By adding this particular line, we are saying that a court has already made the decision that this order.... It has already been authorized to be disclosed.

Unless I'm missing something, I think we're conflating two different issues here, to some degree. What's your take on that?

[Andre Arbour]

I appreciate the intent behind the consideration of my understanding there. Because the text of the amendment replaces “is necessary...to secure the Canadian telecommunications system” with only “is authorized by an order” and then sets out that the order is granted by an “application by the Minister” to the Federal Court, that sets the gating factor there.

Proposed paragraphs 15.5(3)(a) and 15.5(3)(b) would give us some alternative mechanisms, but they're pretty limited. We'd essentially be relying on the telecom operator we collected the information from to consent to its disclosure.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Yes, that's fair enough.

Thank you.

[The Chair, Liberal, Heath MacDonald]

There is no further discussion.

We'll go to a vote.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

I request a recorded vote.

[The Chair, Liberal, Heath MacDonald]

Thank you, Mr. Kurek.

(Amendment negatived: nays 7; yeas 4 [See Minutes of Proceedings])

[The Chair, Liberal, Heath MacDonald]

CPC-12.1 is defeated.

We're on G-6.

Mr. Gaheer.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

Thank you, Chair.

This amendment specifies that when confidential information is shared between parties under proposed section 15.6, that information must continue to be treated as confidential. Under proposed section 15.6, information, including confidential information, can be shared between certain parties, including the Minister of Innovation, Science and Industry, the Minister of Public Safety and the Minister of National Defence, for example.

Thank you.

(Amendment agreed to [See Minutes of Proceedings])

[The Chair, Liberal, Heath MacDonald]

CPC-13 is withdrawn. CPC-14 is withdrawn.

We're on BQ-9. I note that if BQ-9 is moved, CPC-15 cannot be moved as it is identical.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

Amendment BQ-9 is pretty straightforward. It seeks to add, after line 29 on page 7, the following:

(3) If an exchange of information occurs under an agreement or arrangement with the government of a foreign state or with an international organization established by the governments of foreign states, the Minister must, without delay, notify the person to whom the information relates of the disclosure and of the state or organization that received it.

This amendment was requested by organizations that appeared before the committee and is simply intended to add protection for personal information or other information that is disclosed by the government.

[The Chair, Liberal, Heath MacDonald]

Is there any discussion?

Ms. O'Connell.

[Jennifer O'Connell, Liberal, Pickering—Uxbridge, ON]

We feel that this amendment is unnecessary, given the other protections, like those in proposed section 15.7. The sharing of confidential information to many groups...there are already restrictions on that. How any non-confidential information can be disclosed.... Again, it's already addressed. Proposed subsection 15.5(3) only allows for the disclosure of confidential information in very limited circumstances.

We don't disagree with the intent. We just think it's redundant because it's already addressed in terms of how information can be shared.

Earlier, we dealt with adding clearer language to the Privacy Act provisions, and then anything around confidential information.... That confidentiality, which is what we just passed in the previous amendment, G-6, carries with it those limited circumstances, even when the information is shared.

We just feel it's not a necessary provision and it's already addressed in those other sections.

[The Chair, Liberal, Heath MacDonald]

Thank you.

Mr. Kurek.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thanks very much, Chair.

My other committee is the access to information, privacy and ethics committee. While it notably prosecutes Liberal scandals, it also does a lot with privacy.

I would ask the officials if they could weigh in. I appreciate Ms. O'Connell's statement about it not being necessary, but I would ask if the officials could weigh in on the specific application of the privacy-related sphere in this and whether the amendments would make a notable difference compared to what is currently listed in the act versus what is in Bill C-26, as well as its applications of the myriad privacy rules that overlap here.

[Andre Arbour]

Perhaps I'll start with the protections that exist, and then explain what this amendment would do over and above that.

There are already restrictions in the text on the ability to share confidential information, which would include personal information. Proposed subsection 15.7(1) has a prohibition on sharing information designated as confidential. Furthermore, proposed subsection 15.7(2) states that even sharing non-confidential information cannot be done if it is used for a purpose that would be penal. We've had some amendments today to further clarify the designation of personal information as confidential and the application of the Privacy Act.

What this amendment would do is specify that sharing any of the collected information with another party has a notification requirement that goes with it. It doesn't prohibit the sharing. It says we need to notify the parties. Given that personal information would already be restricted from being shared to begin with, we would be talking about notifying the telecom operators each time we share non-sensitive information with an ally. Essentially, we collect a range of information, such as the number of cyber-incidents over the past year and the causes of those incidents. Were we to share that information with an ally, we would then have to notify each of the telcos.

On the one hand, protections regarding personal information exist. On the other hand, it creates the unusual circumstance where we would be notifying the telecom community of international relations discussions.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

I'll just follow up on that.

I know there are often exceptions for national security and whatnot. How can Canadians trust that, when an exception is laid out in Bill C-26...? This is larger than the conversation about this current proposed section. The minister is given discretion quite often to ensure they can use information if it's related to national security, etc. How can Canadians trust that the right balance is struck? This is a bigger conversation, but I think it will help speed up some of the forthcoming amendments.

Could you outline the processes in place to ensure that privacy is in fact protected and that, when an exemption is laid out in legislation, it's not opening it up for abuse?

[Andre Arbour]

First, I'll start with the scope of the information that can be collected. It can only be collected if it's related to an order to protect the Canadian telecommunications system—to inform the development of an order, or to enforce or promote compliance with an order. Off the bat, the information of concern is not personal information. It is the corporate information of the telecom operators that own and operate the telecom networks we're dealing with. Personal information—web-browsing behaviour and what have you—is not germane to that. We cannot collect information that is out of the scope of the existing text.

The amendments that were passed just now further make that clear in the provisions for designating confidentiality. There are a number of factors that allow for what information can be designated as confidential. They make it clearer that personal and de-identified information as captured is there, along with making it clear that the Privacy Act applies.

Finally, under proposed section 15.7, there are two provisions that state that any information designated as confidential—for instance, personal information—cannot be disclosed internationally within this scope. At a few different steps—in terms of what information can be collected at the outset, or if, by some chance, personal information was provided by accident—the limitations on what we could do with that information set out a regime that does not involve ministerial discretion.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you.