Thank you.
As I was saying, the Canadian Civil Liberties Association has raised significant concerns with regard to Bill C-26, which, again, is as referenced in clause 124. I'll just read their submission here so that we can consider it in our deliberations on whether or not we believe that we want to approve this coordinating amendment clause in the legislation. They state:
The Canadian Civil Liberties Association...is an independent, national nongovernmental organization that was founded in 1964 with a mandate to defend and foster civil liberties, human rights, and democratic freedoms of all people across Canada. Our work encompasses advocacy, research, and litigation related to the criminal justice system, equality rights, privacy rights, and fundamental constitutional freedoms. Working to achieve government transparency and accountability with strong protections for personal privacy lies at the core of our mandate.
In this submission, CCLA speaks to Bill C-26, the Government of Canada's telecommunications and cybersecurity legislation. This submission addresses the concerns Bill C-26 raises for human rights and civil liberties, with a particular focus on privacy. Cybersecurity is an essential part of national security, and the digital ecosystem in which we increasingly live our lives needs to be safe, reliable, and secure from threats. Cybersecurity is also crucial for our democratic institutions, the economy, critical infrastructure, national defence, and the privacy of our online life. It is important that Canada take steps toward protecting the digital foundations on which modern life is built. However, in its current form, Bill C-26 risks undermining our privacy rights, due process and the principles of accountable governance—all of which are part of the very fabric of our democracy. [Bill] C-26 must not pass without substantial revisions to protect fundamental rights and due process.
This submission makes recommendations for how Bill C-26 can improve the way government and telecommunication companies define, handle, and protect individuals' personal information and thus protect individuals' right to privacy. Privacy is, after all, an essential component of individuals' personal sense of security, both off- and online, and stands to be positioned more centrally in [Bill] C-26. CCLA believes that our recommendations enable the legislation to better fulfill its stated objectives: bolster cybersecurity across the financial, telecommunications, energy, and transportation sectors, and help organizations better prepare, prevent, and respond to cyber incidents.
The amendments outlined in this submission echo the Joint Letter of Concern that CCLA sent with civil society partners in September 2022. In addition, our recommendations are consistent with those contained within the “Fixing Bill C-26 Recommended Remedies Package”, of which CCLA is a signatory, as well as with the recommendations in Christopher Parsons' report, “Cybersecurity Will Not Thrive In Darkness”.
It's the second time that's been referenced. I think we'll be bringing that up again shortly.
The next section is “Defining Personal Information”.
As it stands, Bill C-26 undermines privacy by empowering the government to collect broad categories of information from designated operators, at any time, subject to any conditions, or even no conditions at all. This may enable the government to obtain identifiable and de-identified personal information and subsequently distribute it to domestic, and perhaps foreign, organizations.
Given the sensitivity of the information people in Canada provide to designated operators, this provision poses an extraordinary risk to individuals’ privacy. Measures must be established to constrain the government’s collection, use, and distribution of individuals’ sensitive information.
In general, the privacy of personal information is one of the keys to strong cybersecurity protections. Building privacy into cybersecurity legislation will go a long way toward ensuring the cybersecurity protections proposed in Bill C-26 are successful. Some degree of monitoring is required to protect telecommunications infrastructure from attack, but this should not come at the expense of personal privacy. There is no excuse for governments to surveil and analyze online activity without clear safeguards for personal privacy and individuals' fundamental rights.
One way to reasonably restrict the government's capacity to collect information is to refine how Bill C-26 conceives of information worth protecting. This would involve codifying personal and de-identified information as confidential. Personal information is any information that can be used to identify an individual through association or inference. Many kinds of information qualify as personal in their capacity to identify an individual; these, according to the European Union's (EU) General Data Protection Regulation (GDPR), include names, ID numbers, location data, online identifiers, or “factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity” of a person.
Further, personal data can be anonymized or de-identified, but de-identified information requires additional protections. Anonymization involves permanently deleting identifying data—