Debates of March 7th, 2023

Transport, Infrastructure and Communities

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Mr. Speaker, I have the honour to present, in both official languages, the ninth report of the Standing Committee on Transport, Infrastructure and Communities entitled “Addressing Labour Shortages in the Canadian Transportation Sector”.

Pursuant to Standing Order 109, the committee requests that the government table a comprehensive response to this report.

I want to thank all of my hon. colleagues for their outstanding work. Thank you also to the clerks and analysts.

Public Safety and National Security

[Ron McKinnon, Liberal, Coquitlam—Port Coquitlam, BC]

Madam Speaker, I have the honour to present, in both official languages, the seventh report of the Standing Committee on Public Safety and National Security, entitled “Up to the Task: Strengthening Canada’s Security Posture in Relation to Russia.” Pursuant to Standing Order 109, the committee requests that the government table a comprehensive response to this report.

Industry and Technology

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Madam Speaker, I have the honour to present, in both official languages, the ninth report of the Standing Committee on Industry and Technology in relation to Bill C-244, an act to amend the Copyright Act with regard to diagnosis, maintenance and repair. The committee has studied the bill and, pursuant to Standing Order 97.1(1), requests a 30-day extension to consider it.

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

Pursuant to Standing Order 97.1(3)(a), a motion to concur in the report is deemed moved, the question deemed put, and a recorded division deemed demanded and deferred. Pursuant to order made on Thursday, June 23, 2022, the recorded division stands deferred until Wednesday, March 8, at the expiry of the time provided for Oral Questions.

Indigenous Affairs

[Terry Duguid, Liberal, Winnipeg South, MB]

Madam Speaker, I am rising on behalf of my friend and our late colleague, Jim Carr, to table a petition from the residents and staff of Shaftesbury Park retirement home in Winnipeg South Centre.

The petitioners wish to bring to the attention of the House the 94 calls to action recommended by the Truth and Reconciliation Commission. The petitioners are urging the government to accelerate their implementation and are specifically noting call to action 8, which calls on the government to eliminate the discrepancy in educational funding for reserve schools. They are also asking for this recommendation to be implemented as soon as possible.

Environmental Protection

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

Madam Speaker, it gives me great pleasure to present a petition to this House from constituents who are concerned about the proposed route and construction of Highway 413 in the province of Ontario. They have outlined a number of concerns with regard to the elimination of farmland, Greenbelt and wetlands, as well as the impacts on greenhouse gas emissions and on indigenous peoples. They are calling on the federal government to require an impact assessment for the Highway 413 project under the Impact Assessment Act.

Questions on the Order Paper

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I would ask that all questions be allowed to stand at this time.

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

Is that agreed?

[Some hon. members]

Agreed.

The House resumed from November 28, 2022, consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts be read the second time and referred to a committee.

Digital Charter Implementation Act, 2022

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, I will be sharing my time with the wonderful member forRosemont—La Petite-Patrie.

I am grateful for the opportunity to rise today on Bill C-27, which is an act to enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act, and to make consequential and related amendments.

The amendments are what I am particularly interested in today. As New Democrats, we will be supporting this at second reading. We support the need to modernize Canada's privacy laws and establishing rules around data governance and empowering the Office of the Privacy Commissioner to bring enforcement actions to protect consumers and citizens.

This bill takes some of those steps. However, there is a need to ensure that reforms are robust and effective. In my opinion, a long list of amendments will certainly be required to achieve these goals.

I am going to be referencing two important works that have been presented. One is from the Centre for Digital Rights, entitled “Not Fit For Purpose - Canada Deserves Much Better”. From the title, we can note that there are some concerns with this bill.

However, we recognize that this privacy legislation must be amended because there are already glaring shortfalls in PIPEDA, which urgently needs updating.

Technology continues to evolve, and data-driven business continues to move away from a service-oriented approach to one that relies on monetizing personal information through mass surveillance of individuals and groups. While these businesses find new ways to expand their surveillance and methods of monetizing our personal information, Canadians' privacy is increasingly put at risk.

The GDPR is the bar that is currently considered the adequate level of protection. However, if we were to do a little bit of comparing and contrasting, we would see that this bill tends to fall short of this level in terms of what the European Commission has done.

What this means for us is that the ability for personal data to flow to Canada without any further safeguards is at risk. There has also been pressure from industry and advocacy groups, the privacy commissioners of Canada and abroad, and privacy and data governance experts. In fact, in this particular bill, we think that the government side has fallen short in its engagement with people; I will get to that in a moment.

When we are in these technological environments, it is an ecosystem that goes well beyond our borders. We are talking about what it is like—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

I would ask members who are having conversations to please take them to the lobbies.

The hon. member for Hamilton Centre.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, I am sure the hon. members from the other side are about to take some good notes on the recommendations we put forward. They are probably discussing among themselves how they can improve upon these serious gaps and have some public engagement on this.

We are not subject matter experts in this House when it comes to this type of technology. It is not clear whether there has been any public engagement specific to Bill C-27 as it is proposed. There was public engagement around the creation of Canada's digital charter, called the national digital and data consultations, that happened back in 2018. However, as I understand it, only about 30 or so discussions were held. That fell dearly short. The majority of digital leaders were from the private sector, and there were only a couple of universities involved. Therefore, it is unclear who the government is consulting with when it deals with this type of surveillance capitalism and the risks it presents to consumers.

Let us get right to the point. What are the gaps that exist in this legislation? How does Bill C-27 compare with the ideal privacy legislation? There are many gaps. Clearly, it does not compare to the GDPR; it also falls short of privacy legislation that is currently being proposed in la belle province of Quebec, in New Zealand and in the state of California.

For example, in California, the California Consumer Privacy Act, the California Privacy Rights Act and the Children's Online Privacy Protection Act have all presented more robust solutions to what is before us here today. In addition, there are privacy protections that come into effect under the CCPA that we should be considering.

We need to ensure that the protections that come into effect include the rights to know, to delete and to opt out of sale or sharing, as well as the right to non-discrimination. Under that legislation, consumers also have the rights to correct inaccurate personal information and to limit the use and disclosure of sensitive personal information collected about them. There is a lot out there that we should be considering when it comes to amendments.

I am going to list examples of gaps within this bill so they are on the record. The bill does not promote the development of data stewardship models. It does not require that organizations take into account the potential consequences to individuals and societies through such measures as privacy impact assessments of a breach of security or safeguards. There is no section in Bill C-27 expressly dedicated to cross-border dataflows.

There has been no privacy impact assessment done to address any additional risks, which should be identified, justified, mitigated and documented in such an assessment. There is no assessment of the broader level of privacy rights protections in foreign jurisdictions. This is a very important conversation, particularly this week in the House, that includes how Canadians' privacy rights can be enforced.

This bill does not include specific rules that are applicable to data brokers, and these are important third parties who are not service providers. There should be a fiduciary duty to individuals if data processors act as intermediaries between individuals and data collectors. This would ensure that such service providers only use personal information entrusted to them for the purpose intended by the individuals.

This bill does not provide the right to disposal with respect to search engines' indexing of personal information where it could cause harm to the individual's privacy or reputation. It does not include the language that was in PIPEDA regarding individual access where it provides an account of third parties to which personal information about an individual or an organization has been disclosed. There should be an attempt that is as specific as possible.

This bill does not include the right of individuals to express their points of view to a human who can intervene or to contest decisions. When we look at AI or how algorithms are working in society today, they are inherently flawed.

In fact, there is another study that I would reference, titled “AI Oversight, Accountability and Protecting Human Rights”, which has commentary on this. This was authored by a series of subject matter experts who gave a long list of needs for adequate public consultation and proper oversight of AIDI to effectively regulate the AI market in Canada.

The commissioner needs to be an independent agent of Parliament. We need to empower an independent tribunal to administer penalties in the event of a contravention, and we need to outline the best practices for auditing and enforcing the law. There are dozens of recommendations contained in both reports that, as New Democrats, we will be presenting to the government at the appropriate time at committee.

It is clear, from the body of the preliminary work that has been done, that this bill is inadequate as it stands. It is too big to adequately cover AI and consumer protections. It has always been our belief that those should be split up. That way we can have an investigation to ensure that consumer protections are met, that surveillance capital does not continue to profit off our most personal information and data and that, ultimately, we have safeguards with a robust and very firm platform on which these organizations, businesses, companies, and in some instances foreign countries, are held to account when they violate our rules.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Madam Speaker, I would like to thank my friend from Hamilton Centre. I see him all the time in our town, and we serve together on the Standing Committee for Access to Information, Privacy and Ethics.

I would ask whether he thinks there is urgency to this legislation, given the fast pace that this technology develops and that companies are using it to develop what can sometimes be invasive and can violate the privacy of Canadians.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, it is clear that Moore's law has extrapolated over the inaction of the Liberal government for the last eight years. We absolutely should have moved on this. However, we need to do it right. It is important that we do not put a piecemeal effort forward to try to keep up with technology that has surpassed our grasps.

There are subject matter experts who know this material better than we do. We need to have an engagement with them at committee, and we need to be able to provide independent safeguards so that when violations happen the legislation actually has teeth to address it.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, I am curious if the member would expand a little more on the artificial intelligence section of this bill.

Our reading of the bill is basically that the government has this vague definition of what artificial intelligence is and that it does not really know, but we should trust the government. The minister will define it all in regulation, will enforce the regulation, will investigate if one has broken that regulation and will impose fines on that regulation without ever having to go to Parliament to decide anything. Therefore, he is going to be judge, jury and executioner on artificial intelligence and on something the government has not defined.

I wonder if the member would comment on that.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, that is an important question. Bill C-27 needs consistent, technologically neutral and future-proof definitions both to the consumer privacy protection act and the AIDA within Bill C-27. It should provide definitions for AI or algorithmic systems that are cohesive across both laws, and the definition for AI ought to be technologically neutral and future-proof. That is the question I just answered for the previous speaker. A potential pathway for regulation is to define algorithmic systems based on their applications, instead of focusing on the various techniques associated with machine learning and AI.

[Mike Morrice, Green, Kitchener Centre, ON]

Madam Speaker, I appreciated hearing the member for Hamilton Centre's speech on Bill C-27. I would like to hear more from him, in particular on subclause 18(3). This section talks about a legitimate interest for an organization to collect a person's private information without consent.

There have been concerns shared here with respect to how open-ended this legitimate interest could be. I wonder if the member would reflect and share more about his concerns, if any, with the way the bill is currently written.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, that is also an important question, because I think what the member did not reference, which I will reference specifically, are the instances where governments used this information.

I think that informed consent is an inherent right to privacy and protection. The AIDA must apply to government institutions, given that the AIDA only currently applies to the federal private sector, as government institutions are explicitly exempt from this. It is imperative that the AIDA's framework be brought in to include government institutions.

Let us be very clear. Individuals ought to always have informed consent about where their information and data go. There ought not to be situations, outside of warrants expressed through our legal system, that allow for the collection, maintenance and distribution of personal information online.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Madam Speaker, at the beginning of his speech, my colleague talked about the progress Quebec has made with Bill 25.

Bill C-27 appears to provide some protection or at least not go against Bill 25, but there is no real guarantee.

Does my colleague think that this is one of the changes that should be made to ensure that Bill 25 in Quebec is not hindered by Bill C-27 and that, instead, these laws complement one another?

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, while I have a growing appreciation for the Bloc's propensity to be here as representatives of the Quebec legislator, I am not here in that capacity.

Any legislation we put forward does have international ramifications that must be met in terms of the international standards related to the protection and collection of data.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Madam Speaker, I want to use my speaking time in the House to note that today is the 85th day of the blockade of the Lachin corridor. This blockade has left 120,000 Armenians in Nagorno-Karabakh without access to health care, food and medication. This situation has been denounced by the European Parliament, by Amnesty International and, last week, by the International Court of Justice. I urge the federal government to do more and apply pressure to ensure that these 120,000 Armenians can have access to food and to prevent a humanitarian crisis.

I am pleased to rise in the House today to speak to Bill C-27, an act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other acts.

This bill includes many things and covers many topics. I want to begin with the part on artificial intelligence. The NDP was a bit concerned by the fact that in the wake of Bill C‑11, this whole new part on the Artificial Intelligence and Data Act was added to Bill C‑27. We think this is a separate issue that needs to be dealt with separately. It is a huge topic in and of itself. We are pleased that the bill is being split so that we can study it in two parts.

In my riding, Rosemont—La Petite-Patrie, there is a burgeoning AI hub that provides jobs for hundreds, maybe even thousands, of professionals. I have met people who were a little worried about the federal government being kind of hasty in dealing with an issue as complex as AI. They are particularly worried about the fact that the U.S. and the EU have laws and regulations already. They think we need to take the time to make sure Canada's regulations are compatible with what is being done elsewhere, with our trading partners and our competitors, just so that it will be easier to attract talent down the line and get these professionals to go work in Montreal, Toronto, Vancouver and other places in Quebec and Canada. They want to avoid the kind of incompatibility that could result in unnecessary obstacles.

With respect to the protection of personal information, I believe that, sadly, a string of scandals has made people aware of this issue, and they realize that our laws and regulations must be updated and adapted. Consider the personal information and data breaches and the problems this causes for people. I will quickly mention a few examples. The problems with Yahoo, Marriott, and Mouvement Desjardins in Quebec, as well as Facebook, all revealed the need for new measures to help victims who have had data and their personal information stolen in several countries. We need only think of the 2019 settlement in the U.S. for the Equifax data breach. It is quite significant, given that Equifax is one of the largest companies people rely on for their credit score so they can make purchases or borrow money. This is not trivial.

Here, in 2019, the Office of the Privacy Commissioner of Canada found that Equifax fell short of its obligations to Canadians and Quebeckers. He then had the company sign a compliance agreement that did not require the payment of any fines or damages for Quebec or Canadian victims. This happened just a few years ago and clearly demonstrates just how outdated Canada's legislation is.

That is why the NDP will be supporting Bill C-27 at second reading. We think it is important that the bill be sent to committee, because we see all the cracks and gaps currently in the bill. It is important that the Office of the Privacy Commissioner be strengthened to bolster enforcement measures to protect consumers and Canadians. Bill C-27 needs to be amended to improve things. There are some shortcomings in this bill. There is even some backsliding in relation to Bill C-11, its predecessor in the previous Parliament, before the last election.

Privacy concerns everyone. In a digital world where social media and online entities are taking up more and more space, we have to remember that, although it is nice to use them sometimes—and they can be of great service—we are the ones who have become the product. Our personal information is the source of huge profits, and we need to be aware of that.

Our information is used to target the advertising we see on our devices when we go to websites. That targeting is based on our personal choices, preferences and searches. Big corporations create profiles and use them to sell advertising. We are the product. These companies make money off the information we give them for free. I have met people who had an interesting suggestion. Maybe these companies should pay us because we are their source of profit. They make money off the targeted advertising they sell, and that is how they plump up their bottom line.

We need to modernize our privacy protection laws. We also need to start thinking about the implications of handing over so much information about our consumer behaviour, our travel patterns, our interests and everything we search for online. We have to prompt people to think about that.

The bill is interesting because it creates a lot of new regulations and a new tribunal. The NDP thinks that is a good thing, but the bill does not go far enough. For example, the bill sets out a private right of action for individuals, but it does not really make it possible for consumers who have fallen victim to privacy breaches to be compensated, unlike what is being done in the United States. This right comes with various rather ineffective stipulations, so although there are new provisions, like this new tribunal, the bill provides for very little recourse.

A few years ago, the NDP published a digital bill of rights for Canadians. In it, we called for new, more effective provisions on consent and the sustainability of data. We called for the government to give the commissioner order powers and to impose larger and more consequential monetary penalties. We also called for transparency with regard to algorithms and more protection against abuse.

I think that the government could draw inspiration from the NDP's digital bill of rights to amend, enhance and improve the bill before us today. Once again, I have to say that this bill takes half steps because it proposes half-measures. There are some rather interesting measures in this bill, but they do not go far enough.

For example, there is still a significant imbalance between commercial interests and individual rights. Unfortunately, the Liberals are still in the habit of putting commercial interests ahead of the rights of citizens. For example, the new preamble of Bill C‑27 tries to present privacy as an individual interest tied to fundamental rights, but still does not directly recognize that privacy is not just an essential aspect of fundamental rights, but a fundamental right in and of itself. It considers the right to privacy to be part of Canadian norms and values, rather than a fundamental right. I think this part of the preamble of the bill should be changed.

There is also some backsliding. Under Bill C‑27, individuals would have less control over the collection, use and disclosure of their personal data, even less than what was proposed in Bill C‑11, which was introduced during the last Parliament. That is really the crux of the matter. If we do not have control over the information we provide or the way it is used or shared, it will be a wild west, total chaos. That is what we are seeing now, in fact. This is a step backwards, and I think that the NDP will be proposing amendments to restore this balance.

Under the bill, information that has been de-identified is still personal information, with some exceptions. There are quite a few exceptions, including in clauses 20 and 21, subclauses 22(1) and 39(1), and the list goes on and on. Roughly a dozen clauses contain multiple exceptions, so it gets extremely complex and confusing. It seems to me that this is going to give big corporations and web giants a way out, through loopholes and back doors. They will be able to do whatever they want because of this list of exceptions.

We in the NDP will be supporting the bill at second reading, but there is still a lot of work to be done to improve the bill.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, certainly from the Conservative side and from the NDP, it seems like we are on the same page when it comes to looking at privacy, protecting privacy and stating that privacy should be a fundamental right, not only in the preamble but also in the clause statement. The clause statement is very important because that is what the bill is derived from. The definition of privacy and fundamental rights then goes throughout the rest of Bill C-27.

One example that came out this week was of our children using a game called Fortnite. There are a lot of other games children spend a lot of time on sometimes, but Fortnite was found to be in breach of error in the U.S. for exploiting our children, taking their data and selling that. Can the member please answer for me how important it is not only to protect our adult fundamental right to freedom, but also our children's fundamental right to freedom?

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Madam Speaker, I thank my colleague for his question, because it is really important. I am not saying that just because I have teenagers at home. We also see the dangers of social media and the fact that young people's privacy or personal information can be exploited. In that regard, once again, Bill C‑27 does not go far enough.

Bill C‑27 includes an interpretation clause stating that the personal information of minors is considered to be sensitive information. However, in the current bill, there is no definition or explicit direction as to what constitutes sensitive information. Once again, the work is only half done. What exactly does “sensitive information” mean when we are talking about information on a minor, someone under 18 years of age?

We will have to move amendments to make this much clearer.

[Monique Pauzé, Bloc, Repentigny, QC]

Madam Speaker, I thank my colleague from Rosemont—La Petite-Patrie for his speech. This is not a subject I know very well, but I am making progress.

I would like to remind everyone, however, that Canada is a digital wild west. There was no legislation that interfered with the commercial interests of these organizations.

In essence, Bill C‑27 is a response to European legislation. Without Bill C‑27, Canada would likely not be meeting the European Union's expectations. The financial community is applying pressure because it is under stress.

My question is going to cast a much wider net. What does my colleague think about the complacency of successive Canadian governments? I am talking about complacency in all sorts of other areas too, including transportation safety, cybersecurity and the environment. What does my colleague think about that?

The Canadian government is always forced to take action when it is pressured by the financial community or other countries.