House of Commons Hansard #136 of the 44th Parliament, 1st Session. (The original version is on Parliament's site.) The word of the day was use.

Topics

Digital Charter Implementation Act, 2022Government Orders

12:25 p.m.

NDP

Lindsay Mathyssen NDP London—Fanshawe, ON

Madam Speaker, I appreciate the complexity with which the bill has been introduced and that it presents to my hon. colleague, and the work involved in going through it. He mentioned the problems in terms of the tribunal process. I know the Privacy Commissioner has raised a lot of concerns.

Could the member perhaps go into a little more detail about the insistence, which our party certainly has, that the Privacy Commissioner has raised, in terms of ensuring that consumers have far more access to fairness within the legislation than organizations typically would have, because they have more monetary resources to pursue things under legal precedence?

Digital Charter Implementation Act, 2022Government Orders

12:25 p.m.

NDP

Brian Masse NDP Windsor West, ON

Madam Speaker, the member for London—Fanshawe's question is something I did not touch on. Again, there is so much in the bill. She is quite right with regard to the fact that if an individual wants to take a legal right of action against an abuse, it is going to be more cumbersome for them, and a company would have a better chance at that.

The tribunal and the division of power with the Privacy Commissioner are going to be very interesting. What I do not want to do is anything that would undermine the Privacy Commissioner. I suppose I am biased in the sense that from my experience, the Privacy Commission has been an excellent model, has done some excellent work and needs more support. That is the other thing we have to do. If we are going to give it more responsibilities, it will need more support. What is worrisome to me is that the tribunal would be a bit disenfranchised from that consistency, and that is one of the reasons we want to see this legislation debated thoroughly.

Digital Charter Implementation Act, 2022Government Orders

12:25 p.m.

Bloc

Jean-Denis Garon Bloc Mirabel, QC

Madam Speaker, we know that businesses and companies find data to be very useful for many purposes, including offering consumers the goods and services they prefer.

However, data can also be used to reduce competition, charge certain selected individuals higher prices for a good, or increase delivery charges for food in locations where there is less competition. Data can therefore be used to stifle competition. It seems to me that Canada's regime is very outdated.

I would like my colleague to comment on whether this bill will provide some sort of justice for Quebec and Canadian consumers, who are presently likely to be taken advantage of by companies that use their personal data without their knowledge and against their own interests.

Digital Charter Implementation Act, 2022Government Orders

12:25 p.m.

NDP

Brian Masse NDP Windsor West, ON

Madam Speaker, that is going to be where we really want to steer, as New Democrats, toward more empowerment for consumers and watching that abuse be eroded. The problem we have is that some of the companies and the lack of competition we have in Canada right now could even lead to greater abuse, potentially, because the information and sharing of data can be done behind closed doors and behind the system of accountability. That will be one of the things to watch for, and that really is the objective of parliamentarians.

I am glad the member has raised that, because I think it is one of the things we do not want to lose sight of. A good example is that we see outright abuse of competition right now. When we had the Loblaws bread scandal, those involved were also putting their money offshore, and on top of that they all ended their pandemic hero pay at the same time, so these are good questions.

Digital Charter Implementation Act, 2022Government Orders

12:30 p.m.

Liberal

Brenda Shanahan Liberal Châteauguay—Lacolle, QC

Madam Speaker, I will be sharing my time with the member for York Centre.

I am pleased to rise in the House today to speak to the digital charter implementation act, 2022, in particular the aspect on the consumer privacy protection act. If I have time, I will also discuss the artificial intelligence and data act.

I am very proud to speak to these two pieces of legislation that introduce a regime that seeks to not only support the technological transformation, but also help Canadians safely navigate this new digital world with confidence. These past few years, Canadians have witnessed these technological shifts take place. They have taken advantage of new technologies like never before. In 2021, more than 72.5% of Canadians used e-commerce services, a trend that is expected to grow to 77.6% by 2025.

According to TECHNATION, a 10% increase in digitalization can create close to a 1% drop in the unemployment rate. What is more, every 1% increase in digitalization can add $8.7 billion to Canada's GDP. In order to take advantage of those major benefits for our economy, we must ensure that consumers continue to have confidence in the digital marketplace.

Technology is clearly an intrinsic part of our lives, and Canadians have growing expectations regarding the digital economy. It is absolutely essential that the Government of Canada be able to meet those expectations.

With this bill, the government is putting forward a regime that gives Canadians the protection they deserve. First, as stated in the preamble of the digital charter implementation act, 2022, Canada recognizes the importance of protecting Canadians' privacy rights. Similarly, the 2022 consumer privacy protection act also provides important protections for Canadians.

That said, our government has listened to the input of various stakeholders, and we have made changes to improve this bill. I was on the committee in the last Parliament, and there was a lot of discussion about the previous bill, Bill C‑11. I am very pleased to be able to speak to Bill C-27, so that we can get all that work done in this Parliament.

One of the most important changes we have made is enhancing protection for minors. Some stakeholders felt that the previous legislation did not go far enough to protect children's privacy. I agree. Consequently, the bill was amended to define minors' information as sensitive by default. This means that organizations subject to the law will have to adhere to higher standards of protection for that information. The legislation also provides minors with a more direct route to delete their personal information. This will make it easier for them to manage their online reputation. I think this is a really important change, because we know that young people are very aware and very capable of using all types of digital platforms, but at the same time, we need to make sure that they are able to protect their reputation.

In addition to protections for minors, we also made changes to the concept of de-identification of personal information. According to many stakeholders, the definitions in the old bill were confusing. We recognize that having well-defined terms helps ensure compliance with the act and provides more effective protection of consumers' information. In that regard, I understand that, because we are talking about new technologies and an evolving industry, it is important for all members to share their expertise, since that will help us develop a better piece of legislation.

The difference, then, between anonymous information and de-identified information needs to be clarified because, clearly, if information is de-identified but an organization or company is able to reidentify it, that does not serve the purpose of having anonymous information.

Data-based innovation offers many benefits for Canadians. These changes contribute to appropriate safeguards to prevent unauthorized reidentification of this information, while offering greater flexibility in the use of de-identified information.

The new law also maintains the emphasis on controlling the use of their personal information by individuals. That remains a foundation of the law, namely that individuals must be able to fully understand the purpose for which information will be used and consent to that purpose in the most important circumstances.

However, the modern economy must also have flexible tools to accommodate situations that are beneficial but that may not require consent if the organization respects certain limits and takes steps to protect individuals.

The approach advocated here continues to be based on the concept of individual control, but proposes a new exception to consent to resolve these gaps as a tool for safeguarding privacy. The new provisions propose a general exception to cover situations in which organizations could use personal information without obtaining consent, provided that they can justify their legitimate interest in its use for circumstances in which the individual expects the information to be used.

In addition, to prevent abuse, the exception is subject to a requirement that the organization mitigate the risk. For example, digital mapping applications that take photos of every street and that we use to view them, particularly to help with navigation, are widely accepted as being beneficial. However, obtaining individual consent from every resident of the city is impossible.

I believe that everyone in the House will agree that it is hard to imagine how we managed before we had access to those navigation applications. Last evening, I had a visit with a family member in Ottawa and was very happy to have my mapping application to find my destination.

The presence of an exception, combined with a mitigation requirement, therefore allows individuals to take advantage of a beneficial service while safeguarding personal information. The example shows another key aspect for building trust and transparency. Digital mapping technology presents a certain level of transparency. The vehicles equipped with cameras can be seen on our streets and the results can also be seen posted and available online.

However, there are some technologies or aspects thereof that are more difficult to see and understand. That is why the bill continues granting individuals the right to ask organizations for an explanation regarding any prediction, recommendation or decision made in their regard by an automated decision-making system.

What is more, these explanations must be provided in plain language that the individual can understand. These provisions also support the proposed new artificial intelligence act. However, I do not think that I have time to get into that, so I will end there.

Digital Charter Implementation Act, 2022Government Orders

12:40 p.m.

Conservative

Rick Perkins Conservative South Shore—St. Margarets, NS

Madam Speaker, the member spoke about the protection of minors. I have a simple question. I cannot find anywhere in the bill where it defines a minor or a reference to “sensitive information”. Could the hon. member please inform the House how the bill defines a minor and sensitive information?

Digital Charter Implementation Act, 2022Government Orders

12:40 p.m.

Liberal

Brenda Shanahan Liberal Châteauguay—Lacolle, QC

Madam Speaker, I appreciate the concern the member brings with that question.

We have many definitions of “minor”, but it is generally understood that it is the different provinces that would legally establish who a minor is. We can understand it being youth using the Internet, and we need to make the extra effort to protect them and ensure they have the tools to protect themselves.

Digital Charter Implementation Act, 2022Government Orders

12:40 p.m.

Bloc

Marie-Hélène Gaudreau Bloc Laurentides—Labelle, QC

Madam Speaker, I commend my colleague. I sat with her on the Standing Committee on Access to Information, Privacy and Ethics for a few months.

We had concerns about privacy. Several recommendations were made, and that is why Bill C‑11 became Bill C‑27. I acknowledge that the bill has been improved. That being said, I wonder about two things.

First, in 2022, I do not think it is right that banking institutions are taking the lead on showing us how important it is to protect privacy. Second, this bill is important, but I would like to know if we should refer it to a committee to study it properly because it is really two bills in one. The first is on artificial intelligence, and the second is on privacy protection. What does the member think?

Digital Charter Implementation Act, 2022Government Orders

12:40 p.m.

Liberal

Brenda Shanahan Liberal Châteauguay—Lacolle, QC

Madam Speaker, I know that my colleague opposite is very interested in this matter because our personal information was leaked by a Quebec financial institution. That was very worrisome.

I believe that it is in the business interests of financial institutions to protect their customers and not to lose them. They have really taken the lead in this area. The provinces have followed suit, but I believe it is also the federal government's role to enhance these protections and ensure that standards exist across the country.

Digital Charter Implementation Act, 2022Government Orders

12:40 p.m.

NDP

Taylor Bachrach NDP Skeena—Bulkley Valley, BC

Madam Speaker, it is notable that Bill C-27 does not explicitly apply to political parties. Given the potential for privacy breaches and other issues to exist in the political arena, I wonder if my colleague across the way could comment on the potential for amending it to explicitly reference and include political parties in the scope of the bill.

Digital Charter Implementation Act, 2022Government Orders

12:40 p.m.

Liberal

Brenda Shanahan Liberal Châteauguay—Lacolle, QC

Madam Speaker, that is a very interesting question, which I believe has come up at different times in this Parliament and previous Parliaments. It is an area, I am sorry to say, that I do not have a lot of insight into, but the overriding principle of safeguarding the information of Canadians has to be first and foremost, especially for any political party that hopes to earn their votes.

Digital Charter Implementation Act, 2022Government Orders

12:45 p.m.

York Centre Ontario

Liberal

Ya'ara Saks LiberalParliamentary Secretary to the Minister of Families

Madam Speaker and hon. colleagues, I rise today to speak about the digital charter implementation act, 2022, also known as Bill C-27.

I thank the member for Châteauguay—Lacolle for sharing her time with me today.

It is an important discussion that is happening among Canadians about what our digital environment looks like. As we know, over the past few years, we have witnessed the constant evolution of our digital environment. Canadians have been successfully navigating through this changing environment, but they have also made it clear to us that they want better protection of their privacy. They want to be able to benefit from the latest emerging technologies with the confidence that they can be used safely. Canadians also believe that organizations need to be fully accountable for how they manage personal information and how they go about developing powerful technologies, such as artificial intelligence, or AI.

From the beginning of our consultations on digital and data, stakeholders have stressed the importance of maintaining flexibility to innovate responsibly and maintain access to markets at home and abroad. I am proud to say that the digital charter implementation act, 2022, which would enact the consumer privacy protection act, or CPPA, and the artificial intelligence and data act, or AIDA, would do just that.

The CPPA represents a complete transformation of Canada's private sector privacy regime, the Personal Information Protection and Electronic Documents Act, or PIPEDA, which came into force in 2001. That was 20 or so years ago. CPPA would introduce significant changes to better protect Canadians' personal information, including strong fiscal and financial consequences for those who seek to benefit from curtailing their legal obligations. This new framework would also ensure that all Canadians could enjoy the same privacy protections as individuals have in other countries.

The AIDA, for its part, is being proposed to build confidence in a key part of the data-driven economy. This part of the bill would introduce common standards for responsible design, development and deployment of AI systems. It would also provide businesses with much-needed guardrails for AI innovation and would ensure that Canadians can trust the AI systems that underpin the data economy.

PIPEDA was passed at the start of the century when other countries and some provinces were moving forward with privacy laws governing the private sector. Recognizing the potential for a patchwork of provincial privacy laws to emerge and the need to align internationally, Canada put in place PIPEDA as a national privacy standard. It drew on best practices to provide robust privacy protections for increased consumer confidence and a consistent and flexible regulatory environment for businesses that allowed for legitimate use of personal information.

The key element for alignment was the recognition of provincial private sector privacy laws as substantially similar. This meant that, where such a law is given that designation, PIPEDA did not apply to an organization's activities within that province. PIPEDA would continue, however, to apply to the federally regulated sector in that province and to any personal information collected, used or disclosed in the course of commercial activities across borders. This has provided a stable regulatory environment and flexibility for provinces, and it has supported Canada's trade interests well for many years.

Today, history is repeating itself, but the stakes are much higher. The role of the digital economy is far more central to our lives than it was 20 years ago. To harness all that the modern digital world has to offer, we clearly need to modernize our federal private sector privacy law. The provinces are moving in that direction and, again, the risk of fragmentation looms.

Quebec has amended its private sector privacy law, and B.C. and Alberta are examining their private sector privacy laws as well. Ontario too is considering introducing a new private sector privacy law. Therefore, the federal government must act now to ensure that all Canadians benefit from a substantially equivalent degree of protection and facilitate compliance for organizations that do business across the country.

Like PIPEDA, the CPPA is grounded in the federal trade and commerce powers. It builds on the best practices developed internationally and by Canadian provinces, and it foregrounds the importance of the ease of doing business across boundaries. The CPPA replicates the approach under PIPEDA, and it updates the mechanism in regulations for recognizing provincial laws as substantially similar. The regulations will set out the criteria and process for such recognition and will continue to provide the flexibility that has been important to PIPEDA's success.

CPPA, like its predecessor, would also maintain the Privacy Commissioner's ability to collaborate and co-operate with his or her provincial counterparts. This is an important tool to ensure consistency, guidance and enforcement, and one that has enabled our commissioners to lead the world in privacy collaboration and co-operation.

Canada also needs to move proactively to regulate in the AI space, given that the operation of these systems transcends national and provincial borders in the digital environment. AIDA would create a common standard that all organizations involved in international and inter-provincial trade and commerce would have to meet. AIDA would place Canada at the forefront of international regulation in the AI space and would provide clear rules across the country. This would spur innovation and build confidence in the safety of AI systems used or developed in Canada.

We live in an interconnected world. Data is constantly flowing across borders. In 2001, the European Commission recognized PIPEDA as providing adequate protection relative to EU law, allowing for the free flow of personal information between Canadian and European businesses.

In 2018, a new EU regulation came into effect that was known as the general data protection regulation. It updated many of the existing requirements and added strong financial penalties for contraventions. The EU is currently reviewing its existing adequacy decisions, including the one that applies to Canada. We expect to hear more on the outcome of this review soon.

The CPPA would make a positive contribution to maintaining Canada's adequacy with the EU privacy regime. It would enable personal data from EU businesses to continue to flow to Canada without additional protections. Beyond the EU, the changes proposed in the CPPA would represent important updates that would bring us in line with other international jurisdictions that have updated their laws. It would ensure interoperability with consistent rules, rights and consequences.

Other jurisdictions internationally are also moving ahead on their AI regulation, and strong action is needed to maintain Canada's leadership position internationally. Interoperability with international partners remains a key priority. The EU in particular has advanced a framework for regulating AI that would set standards for any AI systems being deployed in the EU market.

AIDA would propose a risk-based approach that would ensure interoperability with the EU while keeping in mind that Canadian context is unique. For example, AIDA would include flexible compliance options in order to ensure that our many small to medium-sized businesses would not be left behind. The proposed AIDA would represent an opportunity for Canada to lead internationally, would ensure market access for Canadian companies and would uphold Canadian values.

The government launched Canada's digital charter in 2019. Its 10 guiding principles offer a foundation on which to build an innovative and inclusive digital and data-driven economy. Ensuring interoperability, a level playing field, strong enforcement and real accountability are clearly reflected in the digital charter implementation act, 2022.

I can assure colleagues that our approach is pragmatic, principled and meets our trading needs. The bill would provide a consistent, coherent framework that Canadians and stakeholders could rely on. With Bill C-27 we would continue to encourage trade and investment and to grow an economy that would extend across provincial and international borders alike.

Digital Charter Implementation Act, 2022Government Orders

12:50 p.m.

Conservative

Rick Perkins Conservative South Shore—St. Margarets, NS

Madam Speaker, one of the important concepts of this legislation is clause 18, which introduces the concept into law of legitimate interests of the business. It says that when there is a legitimate interest of the business, it can choose to use a person's data for something that it did not intend, if it is of more importance to the business and it does not think it would cause too much harm to the individual.

I wonder if the member could tell us why the government believes that a company has a right to use an individual's data without their permission.

Digital Charter Implementation Act, 2022Government Orders

12:50 p.m.

Liberal

Ya'ara Saks Liberal York Centre, ON

Madam Speaker, this legislation is important right now so that we can weed out what is not legitimate. We all have these phones. I have one. It tells us when we have been to the grocery store, it tells us when our flights are on time and it tells us where we are in the world. We acquiesce to that every day and that data is used. In the same mind, we want to make sure that when businesses, large or small, have access to that information, because we have agreed to it in theory, that it is guard-railed and it is protected.

That was a great question, and I think that is exactly why we are moving on this legislation.

Digital Charter Implementation Act, 2022Government Orders

12:50 p.m.

NDP

The Assistant Deputy Speaker NDP Carol Hughes

I want to remind the hon. member that she is not to use her phone as a prop in the House.

Questions and comments, the hon. member for Laurentides—Labelle.

Digital Charter Implementation Act, 2022Government Orders

12:55 p.m.

Bloc

Marie-Hélène Gaudreau Bloc Laurentides—Labelle, QC

Madam Speaker, it is a beautiful Monday morning, particularly since we are talking about a bill that will likely make things easier for people who, unfortunately, did not give their consent or whose personal information was compromised.

I will repeat my question, which I unfortunately did not get an answer to. Does the government intend to thoroughly analyze this bill and invite enough witnesses to ensure that it is clear for all legislators?

Digital Charter Implementation Act, 2022Government Orders

12:55 p.m.

Liberal

Ya'ara Saks Liberal York Centre, ON

Madam Speaker, as part of the ethics committee team, I have already begun these deep-dive discussions on the impact of AI on privacy. We have looked at the mobility data of movement as it pertained to the pandemic. I can rest assured that I have an interest in this at committee, whether it is at ethics, at justice or wherever this lands, to make sure that we get those answers. Consumers and Canadians have a right to know how their data is used and to understand when it is used and the purpose for it.

I am deeply encouraged by our work at committee and what we have done, and I look forward to the discussions that will be ahead.

Digital Charter Implementation Act, 2022Government Orders

12:55 p.m.

NDP

Laurel Collins NDP Victoria, BC

Madam Speaker, privacy rights are so critical. When they are violated, consumers deserve to be compensated. There have been numerous examples in the United States where consumers have been compensated in the realm of hundreds of millions of dollars. For the same breach here in Canada, consumers have not been compensated.

I am wondering if the member would support amendments that would ensure that, in Bill C-27, there is parity, and for the same breach, Canadians and Americans would be getting fair compensation.

Digital Charter Implementation Act, 2022Government Orders

12:55 p.m.

Liberal

Ya'ara Saks Liberal York Centre, ON

Madam Speaker, as I mentioned in my speech, part of the act and its contemplation is financial consequences for misuse of the act, in terms of privacy and data breaches, so it is certainly something that would come up.

I heed warning. The member and I have talked about this in terms of the Volkswagen case in the U.S. and Canada. We need to compare apples to apples. It is a bit of apples to oranges when it comes to the litigious nature of the United States in terms of compensation and the guardrails that are here in Canada. We should always be mindful of that. While in principle we want to make sure that there is accountability and transparency in the use of this, and that with accountability comes financial penalties, I would like to make sure that it is a made-in-Canada approach.

Digital Charter Implementation Act, 2022Government Orders

12:55 p.m.

Conservative

Rick Perkins Conservative South Shore—St. Margarets, NS

Madam Speaker, data is used for good and data is used for evil. Data is money, data is power and data is knowledge. Data can improve our lives. Data can also harm our lives. Data tells the story of our lives, and our personal data flows globally. The amount of data in the world has doubled since 2020 and is expected to triple by 2025 according to Statista, 2022.

To understand why we need modern privacy rights in the digital world, it is important to understand that businesses have evolved from providing a specific service, like a social network such as Facebook and Twitter or a search engines such as Google or Microsoft to find things, to using data to gather information on individuals and groups, to manage and deploy people's data and to sell their information to others and sell them goods and services.

We have evolved from businesses providing these services for interest to businesses using these services for surveillance on us and making enormous amounts of money on our personal information. As legislators, we must balance the uses of data collection with an individual's right to privacy. It is a delicate balance that Bill C-27 aims to address by modernizing our privacy laws.

At the heart of this long overdue revision to our privacy laws must be the rights of the individual. In my view, commercial usage of data under privacy law should be secondary to personal privacy, and should only be focused on how business interests enhance personal needs and how commercial entities protect individual privacy rights. My remarks today will focus on why this legislation falls far short of what individuals, groups and businesses need for a clear legislative framework of data collection and management of personal information in this digital age.

First, Bill C-27 is really three bills in one omnibus bill. The first bill would update privacy law. The second bill contains a new semi-judicial body and would potentially duplicate what the Privacy Commissioner could do while removing the right to go to the courts. The third is a rushed bolt-on bill on artificial intelligence that does not, in my mind, have much intelligence in it. The Liberal legislation manages to weaken privacy and put up barriers to innovation at the same time.

Bill C-27 fails Canadians right up front in its preamble. Despite demands from privacy advocates over the last few years, the government has failed to recognize privacy as a fundamental right in the preamble. The bill states that individuals' personal information should have the “full enjoyment of fundamental rights”. This is clever language that avoids giving personal privacy the recognition that it is a fundamental right or a fundamental human right.

The wording “full enjoyment of fundamental rights” in the preamble needs to be amended from “of fundamental rights” to “as a fundamental right”. Furthermore, leaving this strictly in the preamble reduces if not eliminates any real legal impact. If privacy is a fundamental right, for it to have true force in this bill it needs to be included as well in clause 5, which notes the purpose of the bill.

Why is privacy a fundamental right? Freedom of thought, freedom of speech and freedom to be left alone are derived from privacy. The legal protections of privacy limit government's intrusion into our lives. In free and democratic societies, we consider these freedoms as essential rights. The rights to think what I want, to say what I want and to be free to choose what I do, what I am interested in and whom I interact with and where I do that in our digital world are data points. To me they are personal information and therefore are part of a fundamental right to privacy.

What does this mean? It means privacy rights under law are prioritized over commercial rights. A rights-based approach serves as an effective check on technology's potential dangers while ensuring businesses can function and thrive.

Government officials have told me this cannot be recognized in the bill the way it needs to be to have true meaning under law and force because it would intrude on provincial jurisdiction. I do not agree, and neither does the Privacy Commissioner of Canada. Both levels of government can regulate privacy and do. The federal government's role is to regulate aspects under its control, including the fact that commerce does not follow provincial boundaries and therefore requires federal oversight.

I believe that most Canadians accept and expect their data to be used to enhance their experiences and needs in our modern society. I also believe that for organizations to obtain the data of Canadians, Canadians must first consent to it, and that if these same organizations find new uses of our data, they need to get express consent as well. Canadians want their data safely protected and not used for things they did not give permission for, and if they choose to end a relationship with a service provider, they want their personal data to be destroyed.

I do not believe Canadians want their personal data sold to other entities without their express consent, and how does Bill C-27 deal with these expectations of Canadians? I think poorly. The legislation, in the summary section, states that the dual purpose of the bill is to “govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities.” What it would not do is place personal privacy rights above commercial interests.

The bill would require express consent in clause 15, and that is true, but a great deal of the bill goes on to describe the many ways in which consent would not be required and how it would be left up to the discretion of the organization that has collected the data if it needs consent for its usage. The bill is also weak in terms of making sure individuals understand consent when given. For consent to be meaningful, the usages proposed must be understood. The lack of definition and the placement of burden of interpretation on businesses expose those same businesses to legal action and penalties if they get it wrong. This lack of clarity may stifle innovation in Canada as a result. The bill needs to ensure that individuals understand the nature, purpose and consequences of the collection, use and disclosure of the information to which they are consenting.

In addition, the bill would give organizations the right to use information in new ways and would require businesses to get an update to consent for this information. That is good and necessary, but the bill would also enable organizations to use the implied consent in subclause 15(5). When combined with paragraph 18(2)(d), this would give businesses carte blanche to use implied consent rather than express consent.

An organization can decide on its own that the original consent implies consent for a new purpose, and they do not need to seek the individual's views. This is a version of the old negative option marketing that was outlawed in the 1990s. Either someone gives consent, or they do not. There is no such thing as implied consent, in my view, and this needs to be removed from the bill.

Additionally, the bill uses the term “sensitive information”, which companies and organizations must determine to protect data, but it does not anywhere in the more than 100 pages define what “sensitive information” is. It needs to be defined in the bill to include information revealing racial and ethnic origin, gender identity, sexual orientation and religious and other affiliations. These are just a few examples.

However, that is not the worst of it. Bill C-27 would introduce a concept called “legitimate interest”. This is a new rule that would rank an individual's interests and fundamental rights below those of the organization that gathered the information, the exact opposite of what a personal privacy bill should do. To do this, subclause 18(3) would allow an organization or business to use information if it has a legitimate interest in doing so. However, here is where it really gets goofy: To try to reduce businesses using our data under the legitimate interest clause for their own needs over ours, the Liberals have decided to limit the power under paragraph 18(3)(b). This clause could prohibit the business or organization from using our information for the purpose of influencing behaviour.

For more than 20 years, since the invention of loyalty and rewards programs, retailers have used people's data to offer products they might enjoy based on their purchasing patterns. Have members ever bought wine online or in store because it said, “If you like this, you might enjoy this alternative”? Have members ever watched a show on Netflix because it was recommended? Have members ever listened to a song on Spotify because it was recommended based on what else they had listened to? Well, guess what. Paragraph 18(3)(b) could now make this service illegal.

The Liberals cannot get express consent right, and they are allowing companies to use people's data with implied consent or no consent at all. The Liberals are also putting the business use of people's personal data above their privacy rights. That is why it is really the no privacy bill. At the same time, the Liberals are making illegal the good parts of what businesses do in enhancing the customer experience by removing the ability to study purchasing patterns and offering products that we might enjoy because of paragraph 18(3)(b). This bill makes influencing people's decisions illegal.

The minister said to me and mentioned in the House in his opening speech on the bill, as have other members today, that he is proud to be protecting children from harm in this digital bill. This 100-page legislation has only one clause related to children. Subclause 2(2), under “Definitions”, states that “information of minors is considered to be sensitive”, but the bill does not define “sensitive” nor does it define what a minor is. Officials tell me that the definition of a minor is determined by provincial law, so each province would have different rules, and companies would have to comply with the different rules in every province.

If the protection of children were really a major purpose, this legislation would devote some space to defining both what a minor is and what sensitive information is. During COVID, minors used many online apps and programs to continue their formal education. There were then and still are no protections under law as to what is done with their data. This technology would be a new normal for our education system. The online surveillance of children resulting from the COVID experience is huge and protections are zero, even with this bill.

This bill needs to define in law, not regulation, age-appropriate consent for minors, and comprehensive rules to prevent the collection, manipulation and use of any minor's data. This bill leaves it up to businesses to decide what is sensitive and appropriate for minors. It is a colossal failure on the minister's main selling point for this no privacy bill.

The bill is silent on the selling of personal data. It needs provisions on the limits and obligations of data brokers. The bill is silent on the use of facial recognition technology. The bill also prohibits using data in a way that produces significant harm and defines it inadequately. For example, psychological harm caused by a data breach and embarrassment caused by privacy loss are not included. The damages role needs to be expanded to include moral damages, since most contraventions of privacy do not involve provable, quantifiable damages.

Creating more government bureaucracy and growth is the true legacy of the Liberals in government. This bill is no exception, with the creation of a body to appeal the Privacy Commissioner's rulings to. The appointed new body of non-lawyers is called the personal protection and data tribunal, and it is the second part of the bill. Frankly, these powers, if they really are important, should be given to the Privacy Commissioner to eliminate the middle man of bureaucracy. There is no need for this tribunal.

Finally, let us turn to the ill-conceived, poorly structured and ill-defined artificial intelligence part of Bill C-27. It really needs to be removed from this legislation and puts this bill's passage into question. AI is a valid area to legislate, but only with a bill that has a legislative goal. That is why I am hopeful that the Speaker will rule in favour of the NDP's point of order, reiterated by our Conservative House leader, which would ensure that part 3 of the bill is voted on separately from part 1 and part 2.

Essentially, this part of Bill C-27 would drive all work on AI out of Canada to countries with clearer government legislation. It tells me the government has not done its homework, does not really know what AI is or will become, and has no idea how it will impact people in our country.

The bill asks parliamentarians to pass a law that defines no goals or oversight and would give all future law-making power to the minister through regulation, not even to the Governor in Council but to the minister. The minister can make law, investigate violations, determine guilt and impose penalties without ever going to Parliament, cabinet or any third party.

It is a massive overreach and is anti-democratic in an area critical to Canada's innovation agenda. Promises of consultation in the process of crafting regulations is too little, too late. It puts too much power in the hands of unelected officials and the minister.

The definition in the bill of what AI is, and therefore what it wants total regulatory power over, is a system that autonomously processes date related to human activities using a genetic algorithm, a neural network, machine learning or other networks to make recommendations or predictions. If we think this is futuristic, it is not. It is already happening in warfare to determine and execute bombings.

Without parliamentary oversight, the bill introduces the concept of “high-impact systems”. It does not define what that is, but it will be defined in regulation and managed in regulation. No regulatory power should ever be given to the minister or the Governor in Council for anything that is not defined in law.

The only thing the bill defines is the unprecedented power to rule all over this industry and the fines to those who breach the unwritten regulations. The massive financial and jail penalties that extend down to the developers and the university researchers for undefined breaches of law as part of the statute are huge.

Unless this portion of the bill is separated when members vote, this AI section is reason alone that the bill should be defeated. AI is a significant need, but it needs a proper legislative framework, one that is actually developed with consultation.

I urge all members to read the bill carefully. Current privacy laws need amendment, but the current law is preferable to this ill-defined proposal. The AI bill would drive innovation and business out of Canada's economy, making us less competitive.

It is hard to believe anyone could get this legislation so wrong, especially since this is the second time the Liberals have proposed updating our privacy laws. Without splitting the bill, without having separate votes and without considerable amendments in committee in the first two parts, the bill should be defeated.

I urge all members to consider this seriously in their deliberations as we go on to the many speeches that we will hear. While this is a critical point of updating our personal privacy, the bill, in its current state, does not do it and it gives equal if not greater rights to businesses and organizations than it does to individuals.

Digital Charter Implementation Act, 2022Government Orders

1:15 p.m.

Kingston and the Islands Ontario

Liberal

Mark Gerretsen LiberalParliamentary Secretary to the Leader of the Government in the House of Commons (Senate)

Madam Speaker, I have heard the Conservatives talk a couple times, as did the member, about the definition of a “minor”. For a lot of people, that is self-explanatory. I think we can assume what is intended by the definition of “minor”. Would the member support this going to committee so questions like that could be answered? If it is a matter of defining that, and the member and others feel so passionately that it should be in there, would it not be beneficial to get it to committee so that discussion could be had?

Digital Charter Implementation Act, 2022Government Orders

1:15 p.m.

Conservative

Rick Perkins Conservative South Shore—St. Margarets, NS

Madam Speaker, I suspect the bill will go to committee given the costly coalition of the NDP and Liberals.

Specifically on that question on defining “minors”, it is not clear in the bill because it does not set an age. We are allowed to drive at 16 and vote at 18. The age of majority can be 19 for consuming alcohol. In the United States, the law for the purpose of the digital economy, I think, defines it as low as 13. That is where some of the confusion will lie.

If people are running businesses and we have all these different definitions in Canada of what a minor is, how are they supposed to determine, for the purpose of managing that database and whether that information should stay there or not, what the cut-off age is? It is too vague.

I am hopeful that is one of the areas, presuming the bill will reach committee with the coalition, that we will study in depth and perhaps be able to come up with a more precise definition.

Digital Charter Implementation Act, 2022Government Orders

1:15 p.m.

Bloc

Jean-Denis Garon Bloc Mirabel, QC

Madam Speaker, I thank my colleague from South Shore—St. Margarets for her speech.

Here are my takeaways from my colleague's speech: Not everything in this bill is black and white, and it could be improved. Also, the Conservatives want to vote against the bill just to prevent it from going to committee. In contrast, I think we can find common ground and amend it.

I have to say that this unwillingness to send the bill to committee does suggest, kind of like what we saw with the bill to amend the Broadcasting Act, that the Conservatives may be under the influence of big corporations that would be happier with no regulatory framework whatsoever rather than an imperfect one that is a work in progress.

I think this kind of approach which consists of arguing against sending the bill to committee could undermine Quebeckers' and Canadians' confidence in our institutions.

Digital Charter Implementation Act, 2022Government Orders

1:20 p.m.

Conservative

Rick Perkins Conservative South Shore—St. Margarets, NS

Madam Speaker, the member for Mirabel and I have some spirited discussions as seatmates.

With respect to the first point, if there is not a separate vote, as has been requested in the point of order, for the artificial intelligence in the third part of the bill, then, yes, we agree that this needs to be defeated because it would really hurt our economy.

In terms of the issue of personal privacy versus companies, in my remarks I made it very clear that the bill is inadequate in dealing with the personal protection of privacy and data of the individual and it places the interest of business over that. We are opposed to this.

Digital Charter Implementation Act, 2022Government Orders

1:20 p.m.

Conservative

Jeremy Patzer Conservative Cypress Hills—Grasslands, SK

Madam Speaker, I share my colleague's concern about the lack of due diligence on the artificial intelligence aspect of the bill. I wonder if the member wants to elaborate on that point a bit more, because artificial intelligence could be anywhere from national defence all the way to something as simple as products people have in their homes. I wonder if the member wants to talk a bit more about the importance of separating that part of the bill.