Debates of Nov. 24th, 2020

Post-Secondary Education

[Some hon. members]

Nay.

Oral Questions

[Alain Rayes, Conservative, Richmond—Arthabaska, QC]

Mr. Speaker, I rise on a point of order.

I would like to give the Minister of Official Languages the opportunity to retract what she said in answer to my question. She misled all parliamentarians and Canadians by insinuating that the Conservatives have not sent any letters over the past five years, which is completely untrue.

[The Speaker, Liberal, Anthony Rota]

I would like to remind members that it is not up the Chair to decide what is true or not true. The Chair's role is purely to ensure that the rules are followed.

I would ask members who are rising on a point of order to indicate which particular Standing Order they believe has been breached.

[Gérard Deltell, Conservative, Louis-Saint-Laurent, QC]

Mr. Speaker, I rise on a point of order.

I do not know which one it is, but I believe there is a fundamental Standing Order that requires members to speak the truth. If there is evidence to the contrary, members must rise and draw the attention of the House to the misrepresentation.

That is exactly what the member for Richmond—Arthabaska did. The minister made a statement, and the member for Richmond—Arthabaska said that the minister misrepresented the facts. He has compelling evidence.

In this case, it is not a matter of debate; it is a matter of the truth.

[The Speaker, Liberal, Anthony Rota]

I will take that under advisement and come back to the House with a ruling as soon as possible.

I do want to remind members that someone may say something with which they do not agree. That is a matter of debate between two people with different perspectives.

[Alain Rayes, Conservative, Richmond—Arthabaska, QC]

Mr. Speaker, I rise to seek the unanimous consent of the House to table evidence showing that the Conservative Party has sent a number of letters to the minister regarding improvements to the Official Languages Act.

[The Speaker, Liberal, Anthony Rota]

This being a hybrid sitting of the House, for the sake of clarity, I will only ask for those who are opposed to the request to express their disagreement.

Accordingly, all those opposed to moving the motion please say nay.

[Some hon. members]

No.

[Gérard Deltell, Conservative, Louis-Saint-Laurent, QC]

Mr. Speaker, with respect to what happened a few minutes ago in the House, you said that it was a matter of debate. I want to be very clear with you that this is not a matter of debate, it is a matter of facts. It is not as though the government were claiming that it is good and we were saying that it is bad. That would be a matter of debate.

The government is stating that there have been no fundamental changes with respect to official languages for five years, whereas the member for Richmond—Arthabaska has real, compelling evidence showing that certain steps were taken. That is not an opinion, it is a fact.

Facts are facts in the House, and I am again asking for unanimous consent to table these documents.

[The Speaker, Liberal, Anthony Rota]

This being a hybrid sitting of the House, for the sake of clarity, I will ask for only those who are opposed to the request to express their disagreement.

Accordingly, all those opposed to the hon. member's request please say nay.

[Some hon. members]

No.

The House resumed consideration of the motion that Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

Digital Charter Implementation Act, 2020

[Greg McLean, Conservative, Calgary Centre, AB]

Mr. Speaker, today, I rise to give my input on Bill C-11, the digital charter implementation bill. I am happy to give this input. It is a timely bill for Canadians because this bill is about access to people's information and, more important, how that information is monetized by others. At a time when big corporations around the world are earning billions of dollars very quickly from information, getting in front of this issue right now for Canadians is very important.

What is being sold? Canadian information is being sold. What do Canadians privately own of their own data? This is the question that should be addressed in this bill. The converse of this, of course, is the targeted marketing and what Canadians get from the fact that they are giving away their information so they are getting back more services that might be tailor-made to them. It is one of those areas where the intent of Canadians not to give away their data and the result of that data that they willingly gave away, in many instances can be very contradictory. Let us tell Canadians first, as my colleague said here earlier, that they are the product.

Phones are listening to us. Computers are listening to us. Sometimes, computers are watching us. Sometimes, when my sons at home have Siri on, they say, “Siri, turn on”. Siri comes on and I tell them, “Siri was listening the whole time because it just turned on when you told it to turn on.” A lot of information is being culled. We do not know which of that is resting with us, and which of that is public information to be monetized by somebody else.

When I read this bill, I saw a bureaucratic solution designed by bureaucrats for use by bureaucrats, with what will be minor effect for the Canadian population in general. As much as we would like to make sure that we actually do deal with the issue around Canadians' private information that is provided online, we do need to make sure that it applies consistently across our country. It is a bubble created by a bureaucracy, and that bubble is lacking any consequences for mistakes and those mistakes will happen within the bureaucracies of the Government of Canada. In essence, from the Government of Canada's level, everything in this bill shows a complete lack of accountability for the government about how it might misplace or misuse Canadians' data.

I recall, years ago, the government's approach to what was the no-call list. There was a lot of telemarketing going on at the time and the government came out with a solution. If people registered their phone number it would ensure they did not receive telemarketing. We all jumped on that because on our land lines at the time we were getting a lot of telemarketing. When that registration came up, of course my land line was registered and it said to put in my cellphone number too. I put in my cellphone number, and the next day I started receiving telemarketing on my cellphone where I never had before. What apparently happened is the Canadian government's site had been hacked and all that information was sold to telemarketers. It is a shame because it got no money for it. My information was given away for free and a whole bunch of telemarketers got something from the Government of Canada that was literally stolen from Canadians. Therefore, my data was somebody else's, without my consent, as a result of my contribution to the Government of Canada.

Consumer pricing protection is something that would fall in the same type of realm. How do we make the Government of Canada accountable for what might happen with the data that we willingly give the Government of Canada? Will there be fines? Do we actually tell the Government of Canada that if it does not protect this information the Canadian government is going to fine the Canadian government and therefore the taxpayers are going to have to contribute to the government's fining itself? It is a bit of an around-the-world kind of trip, much like quantitative easing.

The problem is, who has this information about me? I do not know, but the party I am forced to disclose the most information to, that I know about, is the Government of Canada.

Let us discuss how stopping that government body in charge of the information I provide is mishandled. That would be the Canada Revenue Agency more than anybody else. It has my financial information, all kinds of dates and my social insurance number. Frankly, having dealt with it for years, it is a disaster of an organization. It has the wrong information. It processes information badly. It is the worst organization to try and fix bad information. That is the Canadian government.

Let us look at what happened in the last handful of months here with the CERB. Data was pilfered and Canadian payments during a pandemic were misdirected. How much of the $400 billion spent is legitimate and how much is as a result of data hacks that went to the wrong entities? Canadians are paying for these mistakes. Canadians are paying now and Canadians are going to continue paying for generations.

The legislation looks like it is designed for large organizations. Let us start with banks. Banks are another organization that we provide a lot of information to and they have a lot of information about us because they handle our financial information. They know how much we are worth, they know how much we have on deposit and they know how much we owe on our mortgages. They are pretty deep as far as what they understand about us.

There are all kinds of small businesses here, as well, that we need to apply. I want to read from this legislation something that should scare any small business person. This is about privacy management programs as required under this legislation. It states:

Every organization must implement a privacy management program that includes the organization's policies, practices and procedures

It further states:

the organization must take into account the volume and sensitivity of the personal information under its control.

What does that mean and how do we interpret that? Further, an organization:

must ensure, by contract or otherwise, that the service provider provides substantially the same protection

They have to ensure something nebulous is provided by their service provider when forwarding information.

Let us get on the ground here. Someone can walk into a pharmacy and that pharmacy wants the Alberta health care number, which is private government information. The retailers want that information so they can continue to track certain things someone does. They know how much of a person's spending they have and they know how much they can market other products to that person if getting some kind of prescription. Government data is quickly translating over into retail data. That is not exactly something we want to provide.

I will go further here because seniors are the people most affected by this. There are so many seniors who are bearing the brunt of the pandemic. There are issues we go through as we age, including financial institutions, insurance companies and all service provides. Many take advantage of seniors in many respects because things get very complex. We want to make sure our seniors are taken care of in a system that continuously evolves, advances and gets more complex. That is something this legislation should take care of more than anything else.

I do not like being just critical. There are also good things in this legislation and I am going to point them out. The purposes of this legislation are that an organization must determine:

each of the purposes for which the information is to be collected, used or disclosed and record those purposes.

The information for consent is also required. Forms of consent are also defined within. The withdrawal of consent is there, as is the disclosure to cease that actual consent.

Another good thing is there is a period for retention and disposal of data that we provide organizations. An organization must not retain personal information for a period longer than necessary. These are very good advances in the legislation. I thank the drafters of the legislation for that.

I have questions on some of the other parts of this legislation as well. On the transfer of information to service providers, organizations may transfer an individual's information to a service provider without the client's knowledge or consent. They would still be monetizing data that gets collected by one retailer or provider and—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

Unfortunately, time is up. I have been giving the member a bit of leeway.

The hon. parliamentary secretary to the government House leader.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Madam Speaker, I am encouraged that the Conservative Party has seen the value of the legislation to the extent that it wants the bill to go to committee, at which I anticipate amendments will be brought forward.

Could the member provide further thought about the implications that have been suggested with respect to the Government of Canada. Does he feel there needs to be specific amendments related to the Government of Canada? Does he want the Privacy Commissioner to do more? What specifically is he thinking about? He referenced programs like the CERB and so forth.

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, there are significant penalties in the bill, such as $20-million, $25-million or $30-million fines or 3%, 4% or 5% of global revenue from an organization. These are going to be pretty significant organizations if we are talking about global revenue. To this point in time, I have not seen how the government calculates global revenue, but I am curious. These types of things do not apply to ma and pa shops and people on the ground collecting information. It is geared toward large organizations.

A question arises from that. We are talking 3% or 5% of global revenue that would flow to the Government of Canada for a transgression as opposed to an individual who lost data. Who still owns the data would be the big question.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, I would like to ask the member to present his conclusion. I would like to give him that opportunity, so he can tell us more about the enforcement powers he would give the Privacy Commissioner of Canada.

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, I have no specific recommendations on that topic at this time. However, I thank my colleague from Quebec for his question.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Madam Speaker, I appreciate some of the thoughtful things the member brought forward about small business, but also, like me, he has raised serious concerns about big banks and how they have not done their part during the COVID crisis.

The Conservatives, like the New Democrats, have been rightly concerned about privacy, especially when the COVID-19 app rolled out and what it meant for privacy. The Conservatives have asked tough questions of government, like we have, that concern privacy remaining ineffective. Could the member talk about how there is no need for a trade-off between privacy rights and other priorities?

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, when we talk about a trade-off, we talk about enforcement more than anything else. If we think about banks, which people often think about when they come to a conclusion about all the disclosure, particularly financial disclosure, they have been under compliance regimes for decades. In effect, when we get down to the ground and the people fulfilling those compliance regimes, we find that it gets watered down to the point where they do not understand those compliance regimes.

Therefore, something that happens at a high bureaucratic level does not necessarily get translated down to the customer level. Getting a real piece of legislation like this down to the level of the clerk and the customer is a monumental task and will not happen overnight.

[The Assistant Deputy Speaker, NDP, Carol Hughes]

We have time for a brief question.

The hon. member for Willowdale.

[Ali Ehsassi, Liberal, Parliamentary Secretary to the Minister of Innovation]

Madam Speaker, I was listening very intently and I am grateful the member has acknowledged that the bill has great improvements and would allow Canadians to feel more secure.

When it comes to the role of government, would the member not agree with me that the Privacy Act does apply to the government that may have some information on Canadians? Obviously that regime is robust—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I do have to allow the member to answer. We are running out of time. When I say a brief question, I would ask members not to provide a speech.

The hon. member for Calgary Centre, a brief answer, please.

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, what I saw in the legislation did not indicate any penalties to the government for citizens whose privacy had been breached. I think for most Canadians, their number one provision of data is to the government, the party they trust the most. That is the party that should probably be the most liable to Canadians for any breach of data, yet there is nothing in the legislation that says that the government owes this duty of trust to Canadians.

[Francesco Sorbara, Liberal, Parliamentary Secretary to the Minister of National Revenue]

Madam Speaker, I will be sharing my time with my colleague, the hon. member for Pontiac.

I am pleased to rise today to speak about the digital charter implementation act, 2020.

Digital technology is changing our economy and our society. Data is now a resource that companies can use to be more productive, to develop better products and services, which has unleashed a digital revolution around the world and which is even more evident during this time of COVID-19.

At the same time, the rapid growth of data-driven industries and technologies is opening the doors to the potential of new and innovative uses of data to support the public good. Data drives the development of many of the algorithms and protected models that are key to our understanding of societal challenges. Examples include the use of data to support sound public health outcomes; enable smart city technologies, such as dynamic traffic management; and promote greater energy efficiency and sustainability through smart grid technologies.

In Canada, public discussions around socially beneficial uses of data have focused on the emerging concept of the smart city in light of waterfront Toronto development proposals and other smart city initiatives considered by federal, provincial, territorial and municipal governments.

The COVID-19 pandemic has recentred the discussion on the role of private sector data and innovation in supporting public health objectives. We are witnessing the central role that data is playing in managing the pandemic. Not only is data critical for tracking current outbreaks or predicting future outbreaks, it has also been used to inform how our health professionals manage critical supplies and ensure they are deployed where they are most needed.

While data has proven to be of vital importance, stakeholders have identified the need for greater clarity around the legal frameworks governing data sharing between businesses and public sector institutions in the context of smart cities and public health.

At the same time, Canadians' concerns over the protection of privacy and democratic responsibility underscore the importance of defining the conditions necessary to establish a certain level of confidence in any new framework. Data sharing can lead to innovative solutions that benefit society.

However, Canadians need assurance that their privacy will be respected and that their data will not be misused. That is why the act to enact the consumer privacy protection act introduces a clear framework for privacy protection in data sharing for socially beneficial purposes.

Under Bill C-11, organizations will also be obliged to obtain consent before disclosing personal information to other organizations. This is in line with the existing act and with most of the legislation on privacy protection in the private sector.

However, in order to support responsible innovation, the bill makes one exception that will allow private sector organizations to disclose de-identified information to certain types of Canadian public institutions for socially beneficial purposes, without consent. This guarantees that businesses will be given the opportunity to participate in public sector initiatives that use data to contribute to the public good.

In addition, by abiding by this framework, private sector organizations can take part in these data sharing activities with full confidence that they are complying with the bill. At the same time, the bill underscores the importance of oversight by democratically responsible public authorities.

As I mentioned, information that is disclosed in this manner would have to be de-identified, ensuring that individuals' privacy is completely protected. What is more, the act would prohibit using that information later to try to reidentify the individual. This prohibition would be tied to significant fines.

This framework would allow Canadians to participate in initiatives directed at socially beneficial purposes without compromising their privacy. It would also ensure that Canadians benefit from the full power of data to create better solutions to some of the most complex policy challenges of our time.

The scope of socially beneficial purposes would focus on areas of public interest that provide broad public benefits supported by use cases and lessons learned that have been identified through years of engagement between government, business stakeholders and civil society organizations.

For example, ride-sharing and transportation service companies could potentially disclose de-identified aggregate data on the movement of their users to municipal authorities as modelling traffic patterns to help improve traffic flow, plan for better public transit initiatives and to improve road user safety.

The law would set clear parameters on which public institutions could receive information under the new consent exception, such as health care bodies, post-secondary institutions, public libraries and other public institutions or private organizations with the mandate to carry out a socially beneficial purpose. Many of these public institutions already have robust data governance systems in place to ensure the integrity of information and protection of privacy and would be ready to take on new responsibilities that would be in the public interest.

The framework for socially beneficial purposes would also cover situations where different levels of government direct public institutions or certain private sector partners to carry out data initiatives. As highlighted in the reports of our colleagues on the policy implications of connected and automated vehicles, this type of public-private sharing of information would be critical to ensuring the safety and security of technologies that would bring incredible benefits to all Canadians.

The approach proposed in the bill would ensure that the law would be adaptable as new use cases emerge and pave the way for innovative new uses of data that could provide broad public benefit while retaining trust and accountability.

Canadians can also rest assured that the new act will protect their information before and after they communicate with these institutions. All personal information transferred will first be de-identified, which will ensure that privacy is protected in these data sharing activities. The consumer privacy protection act also contains clear rules that will prevent the identification of this information, as well as severe penalties for organizations that break these rules.

The framework for socially beneficial purposes will allow innovative Canadian businesses and public organizations to take part in resolving the greatest social challenges in areas such as health and environmental protection. This could improve research on the pandemic, enhance environmental sustainability and conservation efforts, and make our roads safer for users.

These actions will be based on clear democratic responsibility and the protection of Canadians' privacy, and will maintain the flexibility needed for future innovative uses of data for socially beneficial purposes.