Debates of Nov. 24th, 2020

Digital Charter Implementation Act, 2020

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, since there are no other questions and comments, I believe that shows that my colleague was very clear. I will try to be clear as well. The bar is high, but I will try to meet it.

Generally speaking, as my colleague said, this bill represents a step forward and addresses several of the Privacy Commissioner of Canada's requests. Quebeckers were profoundly shocked by the Desjardins data breach. It was a very significant event. However, it was not the only one. Similar incidents occurred in 2017 and 2018, and there have probably been dozens more that we are not aware of. In fact, when a bank's data is stolen, the bank is required to inform the police and the Privacy Commissioner of Canada, but it is not required to inform the public or even its customers.

We like this bill because it sets out a series of principles relating to the collection and sharing of personal information by companies: free and informed consent for the collection and use of data; the ability to allow or deny the transfer of data to another company, such as between two financial institutions; the ability to withdraw consent or request that data be deleted; transparency about the use of algorithms that use personal data; and stricter criteria for the use of de-identified data. This bill also gives real powers to Canada's Privacy Commissioner, sets out significant penalties for non-compliance, and creates the personal information and data protection tribunal. All of that is great.

Unfortunately, the problem is that the bill omits one extremely important element, and that is protecting people's identity online to prevent fraud due to identity theft, especially during financial transactions. We know that Europe has brought in a whole suite of regulations to force financial institutions to verify a person's identity before authorizing a transaction. There is nothing like that in Canada, and this bill does not have anything of the kind either.

The federal government is not properly verifying individuals' identity before authorizing electronic transactions. We know that the challenge is to prevent data from being stolen and used to commit fraud. Having personal data stolen is unpleasant enough, so all measures must be taken to ensure that the data are not then used for fraud.

The debate in Ottawa over the massive data breach at Desjardins mainly revolved around social insurance numbers. We know that several people would like to change their social insurance numbers, but under the current system, they cannot do so unless they become a victim of fraud resulting from identity theft.

In addition, the federal government has received a number of requests to redesign the social insurance card to make it harder to counterfeit, similar to what Ottawa did with passports after the September 11, 2001, attacks, at the request of the United States.

These two requests are perfectly reasonable. The Bloc fully agrees and is asking Ottawa to follow up. However, that alone will not stop fraud.

The best way to prevent identity theft is to make sure that the person who is making the transaction is indeed who they claim to be. This goes without saying. There are three ways to verify a person's identity.

First, a person can be identified based on what they know, namely personal information such as their name, address or social insurance number. However, as cases of identity theft are on the rise, it is getting harder and harder to accurately identify someone. In other words, our private information is no longer private when everyone can find out almost everything about us. Fraudsters can simply use this information to create a fake ID, and they are set.

Second, a person can be identified based on what they have, such as their computer's IP address, which the institution can recognize if the transaction is being conducted from the person's home, or their cell phone, to which the institution can send a secret code via text message.

Third, a person can be identified based on who they are. The institution can use technologies that recognize a person's physical characteristics, such as their voice, their facial features, through the use of facial recognition, their digital fingerprints, which are increasingly being used by cell phones, or their handwritten signature.

Europe adopted regulations in 2016 requiring financial institutions to use at least two of these three ways to identify someone before authorizing a transaction. Banks in Canada are under no such obligation. If they believe that the control mechanisms will cost more than the losses they are currently incurring in fraud, they are better off doing nothing. The banks will not pay for controls that would be more costly than the fraud. That is simply profit-driven logic.

Many members have probably had the experience of having a store issue a credit card on the spot, based solely on the personal information we provide. We just have to give our phone number, address, and so on, and that is all it takes. This practice really opens the door to fraud, and it has to stop.

We believe that the banks must be forced to tackle fraud. That is the solution that we are advocating. We are going to propose possible approaches. As my colleague was saying, we are going to support the bill, but we will be bringing forward amendments. We will have concrete, constructive and coherent proposals when the time comes to study the bill in detail.

We will propose ways to combat identity theft, such as by drawing on the European regulations I was talking about, in order to force the banks to bring in robust processes to verify people’s identity before authorizing a financial transaction. We will also propose to increase fines in order to encourage banks to better protect their customers’ personal information. We will propose that banks be required to submit a detailed report, as part of their annual reporting, on the number of identity thefts and the resulting losses.

We will also propose a requirement to contact any person whose identity has been fraudulently used within the organization, regardless of whether an account was opened or not. As I said earlier, there is no such obligation in place and it must be brought in. There is also an obligation to cover the costs paid by victims to recover their identity. These costs must be covered by the banks, which are rolling in a lot more money than individuals and most of their customers.

There also need to be anonymous tip lines for employees who are aware of unreported identity theft, as well as protection for whistleblowers. There is currently a void when it comes to whistleblower protection, as in virtually all areas. I am getting a little off topic, but the House will have to deal with this issue as well.

Ottawa also has to look in its own backyard. Beyond the banks, the same anti-fraud controls need to be imposed on the federal government itself. Bill C-11 applies only to private businesses. It does not apply to the federal government. Currently, Ottawa’s online identity controls are clearly inadequate. Before authorizing a transaction, the government does not take all the necessary steps to ensure that a claimant is who they say they are.

Since last spring, there have been numerous cases of identity theft. These include Canada emergency response benefit claims made in other people’s names and tax refunds being redirected to other accounts. Some people will not find out that they have been victims of identity theft until they file their income tax returns. It has not yet happened yet, but it will soon. In a few months, many people will discover that they have been victims of fraud. Right now, they have no idea. This is absurd, and it is unacceptable.

Again this fall, thousands of taxpayers lost access to their Service Canada account, which prevented them from applying for employment insurance even though they lost their jobs because their region was going back into the red zone.

It is all well and good to introduce a bill on the management of personal data by private companies. I want to stress that we agree on this bill and that we will vote in favour of it. That part is settled.

However, Ottawa needs to clean up its own backyard as soon as possible and take immediate action to combat identity theft. We are saying yes to regulating private businesses, but we are also saying yes to regulating Ottawa and the banking industry.

[Randy Hoback, Conservative, Prince Albert, SK]

Madam Speaker, my colleague mentioned that the government should be looking to include identity theft in the legislation. I agree with him that it should be included, but this is the government that brought in the Phoenix pay system, and we know how much of a fiasco that was.

What would he propose the government do to prevent something like the Phoenix pay system if it was to bring this type of legislation into its own house?

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, the Phoenix pay system is indeed a fiasco, a complete disaster. I completely agree with my colleague, who I want thank for his kind words about my speech.

This is a big problem, but the bill that is before us deals with identity theft. The Phoenix pay system is another issue, but we completely agree that something needs to be done ASAP, as they say.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Madam Speaker, it should be noted that it was actually the Conservative government that brought in the Phoenix payroll system. We did flip the switch on it, but it was fairly well established under the previous administration.

Having said that, the member, as well as his colleague, made reference to individuals who collected the CERB but who should not have been collecting the CERB. In hindsight, would the member have any recommendations or suggestions for how the government could have done things differently to avoid that?

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, I thank the hon. parliamentary secretary for his question.

I think that I answered that question in my speech. Stricter oversight and monitoring mechanisms like the ones I suggested are the answer to that question.

We could also review the whole matter of the CERB. We warned the government many times from the beginning about the monitoring that should be done and the formula itself. I could talk about those mechanisms again, but I do not really have time. I made suggestions to that effect in my speech.

Looking back, the government should have monitored this more closely in every respect.

[Heather McPherson, NDP, Edmonton Strathcona, AB]

Madam Speaker, I would like to thank my colleague for his intervention today. It was very interesting.

Cybersecurity, of course, is a very important issue. As we know, in Canada there are too many victims of cybercrime each year. However, I feel it is not a problem that a privacy law would solve.

I am wondering if the member could speak a bit about why he is bringing forward a criminal law issue that would put more burden on Quebec and some of the other provincial jurisdictions at this time. I would like a few comments on that.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, if I understood my colleague's question about criminal law, the bill in this current form suggests penalties for companies that break the law. That would involve criminal law.

If I understood the question properly, that is the response I have for my colleague.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, I can always count on my Bloc colleagues to explore the relationship between the federal government and the provincial governments.

I am wondering if the member has any comments on concerns he might have regarding the bill and provincial jurisdiction.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, I will try to be brief, although I know that is not my strong suit.

The Government of Quebec is currently in the process of modernizing its legislation on this. There is a stereotype about Quebec and I believe it is founded: Quebec generally does very good work and often, or in most cases, does a much better job than Ottawa.

Of course, we also think that the governments have to agree. We hope that this new legislation will not encroach on provincial jurisdictions. Earlier I asked the hon. Minister of Industry that question and he said that would not be the case.

Time will tell.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I am pleased to participate from my office in this important debate on Canadian privacy. The bill would enact the consumer privacy protection act and the personal Information and data protection tribunal act. It would also make consequential amendments to other acts. We are debating a fairly complicated subject, but one that has been warranted for many years.

The New Democrats have been calling for a modernization of our privacy laws and our consumer protection laws for about a decade. Most recently, our efforts have resulted in a digital bill of rights' discussion across Canada in which we have been at the forefront and have pushed hard to have some of these rights discussed, not only in the public forum but also in the chambers of Parliament.

We have witnessed the world move on. We have seen the Privacy Commissioner identify Canada as backwater when it comes to protecting privacy and the capabilities of the modern world. With COVID-19, we see further online activity among Canadians and further vulnerabilities for not only individuals but for our families, schools, businesses and even Parliament.

The New Democrats have a different position from other political parties. We believe that people's human rights are connected to their digital rights. People's online presence and the digital footprint they leave in the wake of the business they have to do is just as important as their physically enshrined rights as a human being.

When we look at what is taking place, even with COVID, and the ability of people to participate online, we have seen the failings of two decades of Liberals and Conservatives to connect Canadians, all the way from Maxime Bernier's program, launched as a Conservative minister, to most recently where we are struggling and scrambling to get Canadians connected.

One of the other things the New Democrats talk about is the affordability of participating in this democracy and not only with respect to one's participation on a regular social basis. As governments have moved more and more services away from brick and mortar to online, we have seen the exposure of Canadian privacy. We have seen that even within government resources, everything from social insurance numbers to other types of breaches that have taken place. We have seen this in the private sector as well.

Canada has often lagged in the private sector, not only in oversight but also in the punishment of those who take advantage of people in the new digital age. In our digital bill of rights, which we presented more than two years ago, we talked about not only personal data being protected, but also how people were being manipulated through the services provided online. For years and years our philosophy has been net neutrality. I will highlight a few new problems with the bill which could derail that type of philosophy and could stream Canadians to more vulnerabilities.

There are all kinds of examples of how Canadians have been abused. Whether it be Yahoo, Ticketmaster, Marriott or Equifax, the list goes on and on. Most recently, a heightened example of this, which created a lot of attention across the world, was Facebook and the outright manipulation of people's personal data. People were being used as pawns without even knowing what their rights were or being protected from that.

Again, Canada's laws do not allow our Privacy Commissioner to come down hard on some of these giants. Governments in the past have been too close with the web giants and have not allowed Canadians to have the proper recourse when data breaches have taken place.

The personal information and data production tribunal act being proposed by the government would create a number of potential false promises for accountability. It has a low threshold of involvement of those who would be appointed to the tribunal.

First, we have to get past the notion that these types of political appointments will be free and clear of all political and business-type leverages to select the tribunal. Second, we have to assume the tribunal can be fair, quick and just in its cases. Third, baked-in problems with regard to the role of the tribunal create some concerns. The first is that the tribunal could overturn the Privacy Commissioner in many respects and it would go to a judicial process, which could take years and years to settle cases that may no longer be relevant to Canadians.

There is also a low threshold for the inclusion of some of the appointments. There is no requirement for a Superior Court judge and only one judge is allowed in maybe a one-to-three-member panel or a one-to-six-member panel. These things need to be fixed.

Something I want to further explore are more powers for the Privacy Commissioner. The Privacy Commissioner has been very clear in asking for more resources and supports over the last number of years to deal with privacy breaches that have occurred and also to bring in more accountability. It is in our business interests, not only our interests as individuals, families and all of the institutions but in business interests, to have a clear process so the bad actors in this environment that are doing harm to Canadians and other businesses are not rewarded.

One thing I am most proud of accomplishing as a member of Parliament was ending the tax deductibility of corporate fines and penalties. That was about 15 years ago. In the past, if a business was caught doing something illegal, it was able to write off part of the government fine as a business-related expense. I was able to champion a change to that.

Businesses that were doing illegal activity and influencing competition were using it as a loss leader. They would essentially get millions of dollars in fines and penalties, everything from drug companies to those getting environmental fines and penalties, and they would apply for that money back at tax time. It was a way for them to undercut the competition that was doing the right thing. That is what I am concerned about with the tribunal. It would have the capability to influence market stability to some degree with regard to penalties and fines for the bad actors.

If it does not work right, if it is not seen as credible and if it does not flow the way it should, it can be an encouragement for some of those committing the breaches to be sloppy with personal information, disrespectful and also manipulative in taking information from Canadians, steering them to different purchases and activities, exposing them and then beating some of the competition. For some young entrepreneurs who have to go up against some of these established giants, it is very difficult for them to get a toehold.

A number of factors are in place, even in our general market economy, for young people and entrepreneurs to get busy and to compete. One most recently was in the retail sector. Businesses are being charged extra to get floor space in the real world. Amazon and other players have also used manipulative practices to steer consumers to particular products and services from preferred customers. That defeats our philosophy of net neutrality. It could also direct people and their families to making purchases or viewing activity with the time they have into different market conditions as opposed to exploring in a free and open Internet society.

Another thing is that Canadian federal political parties are exempt from oversight. We do not understand why the Liberals would allow this to take place. It should be clear and proper that their data and personal information be open and accountable in political parties as well. We will be looking at amendments to this activity because we strongly believe they should be accountable.

To bring faith and accountability to our democracy requires transparency. We have seen the sensationalism that has taken place in political advertising in the last number of campaigns and the favouritism that has been seen online. We have also seen the giant data assembly that has taken place which can manipulate voting and steer people to different discussion points.

The personal privacy information collected by political parties should also be clear. This way there will be more faith in the information that political parties get. More important, our democracy will be strengthened by privacy protection, not weakened or exempted with regard to the model being presented by the government right now.

We also want to be more technical and continue to have commercial activity defined under PIPEDA. This is more related to the business section aspect for fair and open transparency.

We want to deal with a particular issue in regard to algorithmic transparency. Algorithms can help direct purchasing and activity and can also manipulate someone. It will just get stronger because artificial intelligence is being introduced more and more into society in regard to all our products and services. This includes search engine searches, the types of purchases made with different corporations and a number of different activities that take place. It is important there be accountability and oversight for that.

A number of different things have been going on with regard to Canadians and their privacy. There is no doubt there will be more challenges with this bill. We want to go back to a number of different structures that take place with respect to this. Again, the New Democrats championed a digital bill of rights for many years. I want to highlight a few important things.

If we cannot have a fair, open and just society with regard to our digital footprint, we believe our democracy is threatened, our economy is threatened and, more important, investments into this country will be threatened. We will not have the same oversight that Europe or the United States have. That is very important to ensure that investment in Canada will take place

It is important to note that if we are working toward things like access to telecommunication services all across Canada and we are investing in this, we need to think about the billions of dollars already spent on this, along with the additional money to be spent. We want this to be done right and proper, especially with COVID-19.

Over the years, as we have gone to more online services and invested in this, we have had opportunities. When we think about how we use this space for ourselves, whether it be commercial activity, entertainment or business, we sell off the spectrum. The spectrum is the infrastructure we can use. It is above us. It is the radio and capacity to move, most recently, the 5G network. We will see a spectrum auction.

In the past 20 years, $22 billion of revenue has come into the public coffers with spectrum auctions. We have seen a patchwork of activity take place all across the country.

I previously mentioned Maxime Bernier, with the Conservatives, and most recently the Liberals. Several plans have emerged that are more a hodgepodge of applications. It is one program after another that is sought out. They are also providing massive subsidizations for those markets, which costs billions of dollars. Even the CRTC has a fund.

I can list a series of them, but the point is that if we are going through all this trouble and investment to create a society space for our digital world and economy and we are heavily investing in this, then we need to do it right, especially with a geography like Canada, which is so large. This can be a challenge, but given our population size and the fact that we have dense populations along the border and other places, we can turn this into an advantage for business investment as well.

The New Democrats believe this is part of our human right with respect to how people are treated online. This includes accountability from companies with regard to cyber-bullying, privacy protection, speeds and affordability. They are combined. If we do not have this type of approach as a philosophical one, we leave ourselves open to having more winners than losers. It would be no different than having lost education opportunities for people and a requirement for the government to come in and do the right thing, which is to make things more affordable.

I mentioned the concentration of our population. It is important we tie this into the bill as we finally expand to rural and remote locations, and the security and accountability for that information.

We have talked a lot about preserving different cultures and providing business opportunities for areas that have been weakened because of their geography or lack of connectivity to large populations, but if we do not put a rules-based system in place that allows them to compete fairly, then they will fall to the wayside. Specifically, we could have a number of opportunities for smaller businesses to evolve, some scale-ups to take place, communities that could actually have some empowerment in getting to new markets and keeping the community stronger and together, but if it is not done in a way to have online privacy protection and so that businesses can compete in a fair way, then it is going to be lost.

One of the concerns we have in general, not only with regards to ourselves as a country but also the rest of the world with some of the web giants, is the consolidation of services and how online services are used. In Canada, our competition has not been the strongest at some points, but there is an opportunity as we do this, which is why this legislation is so important.

With the spectrum auction coming up, New Democrats have argued that charging as much money as we can to the telcos coming in and then seeing how things go results in what we have right now: less competition and higher prices, and prices that, quite frankly, limit people's participation in the digital world. This is a concern that we have, and so we have suggested to turn the spectrum auction around, like many other countries have done, and use it as a way to connect at lower costs by putting out expectations, such as an RFP-type model. When the bidding comes in, we may get a little less money coming in the front door, but the expectations are going to be higher and the requirements to connect rural or remote communities will be there. The telcos will use it or lose it. That is one of the things we believe could be a real benefit to move along the different programs.

Basically, what we have now is a series of programs out there where communities almost have to go on bended knee to get access, to get support to actually lower the price points to make things more competitive and attractive. Our model would have a reverse role. The business community would already have the expectation that the spectrum is less, but the time frame to connect Canadians is high, with the expectation that they use it or lose it, for those things to happen relatively quickly. In fact, industry has indicated that the NDP plan could take place and connect Canada within four years: 98% in three years and the last little part in the last year, because it is more difficult in some locations.

This is important and critical, because this potential law would lay out the framework on how that activity takes place. It is one of the reasons we believe this tribunal is one of the more interesting curiosities, and there are other things to talk about regarding that. However, if we spend all of this money, time and public policy and then do not get it right, we would have a weak and irresponsible approach to oversight in making sure that Canada does not have problems with regards to this. It is already going to create a skew in the public policy laws that we have. I fear that the bill, in its current form, if it does not sharpen up on those points, would create a skewed market for some years to come.

Parliament most likely will not deal with this again any time soon. It has taken far too long to get to this point. We have to get this through a minority Parliament, we have to get it through the Senate and we have to get it signed off by the Prime Minister at the end of the day. That is going to take some time and commitment, which we have with the New Democrats. We want to improve the bill, we want to make sure that it is stronger, but if we do not get these points right, we are going to undermine things. This is why, when we think about how important this is with our current public policy and our resources, everybody out there has been concerned about COVID-19 and the effects upon the broadband and the experience for education, involvement and commitment.

To conclude, the difference for New Democrats is that we believe that our human rights and digital rights are enshrined just as our physical rights. As we move to this type of engagement, as we see hybrids take place within workplaces, schools and other types of activity, this bill is a step forward, but it needs to be strengthened, and we can be counted on to do that. It is our intent to make Parliament work, but, more importantly, to make sure that we have laws that are going to work to protect Canadians.

[Gary Anandasangaree, Liberal, Parliamentary Secretary to the Minister of Crown-Indigenous Relations]

Mr. Speaker, I want to pick up on the enforcement mechanism in the bill, which would be the establishment of a new tribunal that would be accessible and able to impose significant fines on those who violate the act. I want to take issue with appointments. As a government, since we took over we put in a very robust appointment process that is merit-based and represents the breadth of this country.

I want my friend to comment on what specific issues he has with such an accessible tribunal, which I believe is warranted in this situation.

[Brian Masse, NDP, Windsor West, ON]

Mr. Speaker, I believe the vast majority of appointments, even when controversial ones have popped up, have been good people doing good things for Canadians. However, that type of appointment process lends itself to some degree of political meddling, corruption and also influence from the outside.

I have been in Ottawa for almost 19 years now, and I have seen a number of different stories played out over the years that give me concern. It is a legitimate concern in this bill, and it also can change with the governments that handle the appointment process. It is something of concern worth talking about.

With regard to who is on those committees and tribunals, it is about the length of time and the types of people on it. Only one of three to six tribunal members would need to have privacy law experience, and that is one specific example of my concern. These are very technical things to deal with.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Mr. Speaker, one of the concerns I have, being from a large rural constituency, is the interplay of this bill and the effect it may have on rural Canada, specifically small and medium-sized enterprises within rural and remote parts of Canada. I am wondering if the member would have comments on that.

[Brian Masse, NDP, Windsor West, ON]

Mr. Speaker, it is one of the key components of what we need to do to get right. As we are expanding into rural and remote Canada, we want to make sure there is even more confidence for the personal protection of privacy. Also, there is a bit of cultural change. So many of us in urban centres who have had access to high-speed Internet and other types of services have been used to some of that abuse, whereas we want to put in protections for small and medium-sized enterprises.

Again, there are a number of different things. Net neutrality is a good example, but there are also algorithms and how they direct traffic and different businesses in different ways. When we see there is abuse taking place, it can also come at the expense of small and medium-sized businesses. One of the changes we are looking for is greater accountability to those formats because people literally put their whole life and efforts into small businesses. It was hard enough as it was before COVID-19, and now it is even worse.

As well, businesses are paying for the connections to be able to be compete. Things we need to bring to account are things like the algorithms.

[Heather McPherson, NDP, Edmonton Strathcona, AB]

Mr. Speaker, my colleague is a leader within our caucus and is very well-informed on this file and very knowledgeable about this very complex issue.

As he knows, I have been working on the heritage committee. We have also been looking at Facebook and the web giants and that cozy relationship the Liberals have with the web giants. We have seen that lobbying over the last few years tripled since the Liberals became the government.

In terms of personal privacy, I am wondering if the member could talk a bit about what he would like to see improved in this bill to make sure that cozy relationship does not get any sort of prevalence.

[Brian Masse, NDP, Windsor West, ON]

Mr. Speaker, I thank the member for Edmonton Strathcona for her hard work on this, and also for reinforcing the protection and strengthening of the Privacy Commissioner. That office has done wonders for this country. I have seen about four privacy commissioners in my tenure in Parliament, and they have all been strong. I have not always agreed with some of their decisions, but they certainly have been at the forefront of accountability in public policy in pushing for greater protection for Canadians. The U.S. does not have this. This is one of our moments of strength that we as a country have in a structure. The member is absolutely correct. We need to make sure the Privacy Commissioner's office is strengthened and remains independent because it has been an asset, not only for personal information but also for our businesses across this country.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, I thank my hon. colleague from Windsor West for his detailed assessment of Bill C-11. It is the first opportunity for me to speak to the bill. I certainly plan to vote for it at second reading to get to committee.

An amendment I hope to pursue at committee is an issue that the hon. member discussed. That is getting the PIPEDA framework in Canada to apply to political parties. Here in British Columbia at the provincial level, political parties have to meet privacy requirements. I commend the member for raising it early in debate, and ask if the New Democratic Party will also support amendments in committee?

[Brian Masse, NDP, Windsor West, ON]

Yes, Mr. Speaker, New Democrats support amendments and we will be proposing several. There is no doubt about it.

I would like to acknowledge that British Columbia's privacy protection for decades has been recognized across North America and different parts of the world. There is no doubt that British Columbia will provide good opportunity for some lessons to strengthen our own Privacy Commissioner as well. That is key.

New Democrats support these changes. We have amendments prepared already, and we will be adding more amendments. We have to get this right. There is only going to be one chance at this in the near future as we are building out and doing things more online than before. We have to enshrine the philosophy that our human rights are connected here. If we do not enshrine that human rights are connected with regard to this, that one's digital rights are like one's physical rights, then we will be lost; and, we cannot do that. We have to win.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Mr. Speaker, I want to ask the member for further comments in regard to the tribunal because that is a critical component here. The member has expressed great concern in terms of the timeliness of decisions being made by the tribunal. I wonder if he could just provide some further thoughts on how that issue could be best addressed. As opposed to focusing his attention on the appointments, are there mechanisms that he could see being put into place that would ensure a more timely response once issues have been raised?

[Brian Masse, NDP, Windsor West, ON]

Yes, Mr. Speaker, the tribunal will be subject to a judicial review, and it could be challenged. The challenge that we are going to be faced with is that decisions could be pushed off down the line. For example, it could take a long time for CRTC decisions to come back and it is one of the most frustrating things. I give credit to our incumbents where they need to be given credit, as they have actually had to deal with a broken system, with CRTC not having the resources and the capabilities to get back in a timely manner. Therefore, the tribunal is going to be critical for that.

Having judicial experience added to it that is stronger than what is currently there and also making sure that some of the powers it has cannot overturn the Privacy Commissioner are some of the things I would like to see advanced in this bill.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Mr. Speaker, I will be splitting my time with the member for Willowdale.

We increasingly live our lives online and our laws need to reflect that reality. Privacy is a human right and it is inextricably connected to our personal autonomy.

The Council of Europe's Convention 108 states, “The purpose of this Convention is to protect every individual, whatever his or her nationality or residence, with regard to the processing of their personal data, thereby contributing to respect for his or her human rights and fundamental freedoms, and in particular the right to privacy.” The GDPR states, “This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.”

The incredible scale of data collection can be a powerful force, both for good and bad, so we need strong privacy and digital rights and a strong regulator to enforce them.

There is much in our government's Bill C-11, which is a serious reform of PIPEDA and certainly long overdue. I remember in June 2018, I introduced legislation simply to give the Privacy Commissioner new powers, which our privacy committee had twice unanimously recommended. We have come a long way since then with this substantive bill. OpenMedia said, “Bill C-11 is a big win for privacy in Canada.”

While I have heard some reflections from experts and certainly from some parliamentary colleagues already about how the bill can potentially be improved, or some open questions about what might need to be fixed, it is certainly deserving of our support at second reading. I look forward to working with colleagues across party lines to improve the legislation at committee where we can.

At this point, to work at committee across party lines something of a detour is required. I want to specifically commend my Conservative Party colleagues from Prince George and Thornhill, my NDP colleague from Timmins—James Bay and my Liberal colleague from Kitchener Centre. We worked very long and hard on privacy issues in the last Parliament. We helped found the International Grand Committee, comprised of over 10 countries, to discuss these issues. We hosted the second meeting of the IGC in Ottawa. We tabled the report “Towards Privacy by Design” in February of 2018.

When we as parliamentarians talk about committee work and often the overlooked nature of the committee work, we do not always see that committee work turn into legislation. In this instance we have.

We recommended stronger consent rules and we see stronger rules in Bill C-11. We recommended algorithmic transparency and we see in Bill C-11 a commitment on transparency where systems are used to make predictions, recommendations or decisions about consumers. We recommended data portability and interoperability. We see those commitments in Bill C-11.

We see stronger powers for the Privacy Commissioner. I mentioned that need for a strong regulator, including order-making, auditing and the ability to levy fines. We see order-making powers. We see the ability to audit. We see a new tribunal, and while I understand some of the caution or questions members are raising in respect of this design, it is consistent with the competition commissioner and tribunal operations and worth looking at more seriously to see if it can be approved. However, through the tribunal, we see the ability to levy significant fines, in the magnitude of $10 million to a maximum of $25 million for more serious fines.

In terms of the course of that committee work, I want to reflect on a couple of stories about why this kind of legislation is so important and critical.

I think it was in the fall of 2017, when we were in the midst of the study on PIPEDA reform, that the member for Thornhill, the former member for Skeena—Bulkley Valley, I believe I am getting that right, and I went down to Washington and met with other elected representatives there. We witnessed some of the hearings in relation to the Equifax breach, but we also met with Facebook officials. At that time, when a question was put by I think the member for Thornhill as to what Facebook's views were on the potential new regulations, they said absolutely no new regulations were required in Canada due to the strong framework through PIPEDA and, if there were new rules, that might affect Facebook's willingness and interest in investing in Canada. Certainly, we have come a long way since those kinds of conversations and push-back by big tech companies against stronger privacy rules.

We saw that Mark Zuckerberg unfortunately did not attend before the IGC, though he said he would like to work with parliamentarians around the world, but we can certainly say that the days of self-regulation are over and asking for regulation. Here is that kind of regulation in Canada.

On consent, I have to tell one other story that happened at committee. Again, we had Facebook officials there. We were in the midst of going down the rabbit hole of the Cambridge Analytica scandal and the Canadian context of that third-party app, which had shared so much information. I think it was under 300 Canadians who had used the app, but thousands of Canadians had their information shared. I put to Facebook at the time, “How is it that on the basis of meaningful consent thousands of Canadians could have agreed that their friends share their information through this third-party app and then share it with Cambridge Analytica?” With a straight face somehow, a Facebook representative said to me that it was in their terms and conditions.

That speaks to the problematic nature of consent in the existing law and the lack of meaningful consent. Thankfully, our Privacy Commissioner, despite his current lack of meaningful powers, pursued that line of inquiry and found that Facebook violated our current laws and took the matter to court. We know that with stronger consent rules, there would have been no ability for a Facebook representative to say with a straight face that there was meaningful consent.

Plain language is important. I would go further, though, and say that as we think about consent, particularly in a consumer context, I think we ought to be more wary of privacy by default. We have to be more concerned about privacy by default. Where there is a reasonable expectation of the consumer that information is going to be shared and used in a particular way, then explicit consent, obviously, ought not need to be required, but where there are secondary uses, where there are uses beyond a reasonable expectation of that consumer then, certainly, we need explicit opt-in consent. It needs to be very clear to consumers how their information is to be used, if at all.

I want to emphasize the consumer context because it is a curiosity of privacy legislation and a curiosity of consumer protection legislation that when I purchase my phone I do not have to read the terms and conditions. There is no expectation by government that I read the terms and conditions, yet I am protected. There are implied warranties pursuant to consumer protection legislation. I do not need to read those terms and conditions in order for my rights to be protected as a consumer, yet there is an expectation when I download any app on my phone that I read the terms and conditions. That cannot be a tenable state of affairs if we want to protect consumers. We cannot expect consumers to read every term and condition, and every consumer contract in the course of downloading applications, and in the course of living their lives, as I said, increasingly online. Our laws need to reflect that reality.

There are obviously some straightforward fixes for this legislation. The membership of the tribunal should obviously have greater privacy expertise. I think that is a no-brainer. We do have to think more deeply through some of these consent rules and how we can strengthen them potentially further. I would like to see us go beyond algorithmic explainability to some kind of algorithmic accountability.

I know that others have mentioned political parties being left out. I do not know that political parties need to be subject to PIPEDA specifically, but they ought to be subject to privacy legislation. If there is no further effort under way by the government, then I think PIPEDA may well be the place to do that.

Lastly, I think we have to focus on children, in particular, when we look at consent rules and protecting kids on the Internet. Previously, I have written and spoken publicly about my support for our right to be forgotten, but I do think we have to be more focused on our rules and protection for kids as they grow up with the Internet and live their entire lives online.

I will close by simply saying that this is a big bill. This is second reading and, certainly, all of us ought to support this in principle. I look forward to working with experts and colleagues to strengthen the bill at committee and get into the details.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Mr. Speaker, one concern that has been highlighted by a number of other colleagues in this place is the fact that the bill may have the unintended consequence of creating an unlevel playing field for small and medium-sized enterprises, versus the big players. The big players have teams of lawyers and departments to deal with this sort of thing, as opposed to the small and medium-sized enterprises that are going to have to grapple with the consequences of this sort of legislation.

Would the member be able to provide some context about any safeguards that may exist or any suggestions that he would have to ensure that there is in fact a level playing field in that regard?

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Mr. Speaker, I would say a few things. First, the concept of proportionality is really important in this regard. Second, it is a live concern that should be addressed by the committee in some respect, but I would also note and would present some caution in response that there are some small companies that collect mountains of personal information. It is not necessarily the size of the company but the activities of the company that we ought to be most concerned about.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, I want to thank my hon. colleague for an excellent speech. I felt I should have written it with him at some points, because we spent so much time together studying this and pushing the government for action. There are some key elements in this legislation that certainly come from our work together on the ethics committee.

I am interested in the issue of algorithmic accountability. I think that is something the ethics committee was way out front on. When I look at the other legislation, about having Facebook and Google under the CRTC, I feel it was the best idea for the 1990s. When we are dealing with algorithmic powers that are pushing extremist content, that are pushing Holocaust denial, and when we have seen how that is the real driver on the big social media platforms, and the inability of parliamentarians to actually look inside that black box, I would like to ask my hon. colleague how he would suggest we actually get some stronger accountability mechanisms on the algorithms that are pushing the content and driving people to certain sites and certain conversations.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Mr. Speaker, I am looking forward to getting back to the ethics committee to work with the member for Timmins—James Bay on these issues.

When we look at the use of algorithms and the use of algorithms combined with just the scale of data collection that we see today, we can narrowly focus in on consumer privacy on the one hand, but on the other hand there are bigger conversations about how that information is used to target messages to us and the implications for our democracy. There is a reason, when we hosted that meeting in Ottawa for the IGC, that it was on big data, privacy and democracy.

In terms of algorithmic accountability specifically, I would say I am not certain yet what the perfect solution looks like, but I have always been interested in the work of the Treasury Board in respect of algorithmic impact assessments. It is clear enough, and I am glad to see in Bill C-11 that there is a commitment to algorithmic transparency.

Going further and having some body, potentially the Privacy Commissioner, able to look under the hood and audit algorithms and their potential positive and negative impacts is important. We need to figure out a way to do just that.