Industry committee  This is an issue that the international community is grappling with. In Bill C-27 you have provisions about making sure that other countries are providing similar levels of protections through contracts. Other regimes have more detailed rules about this, for instance, looking at the GDPR, which has the adequacy regime.

Industry committee  It's principles-based, because it needs to be technology neutral. It has to be legislation that will stand the test of time. It's 20 years old, and the Privacy Act in the public sector is even older, so we need this legislation to keep up with fast-moving technology. We're talking about principles, but we also need in legislation some specific obligations, so that organizations and Canadians know their rights.

Industry committee  Yes, that brings us more in line with Europe's standards. In fact, the European Union's General Data Protection Regulation, or GDPR, explicitly recognizes that, as does Quebec's regime. In all my international meetings, there was a consensus: privacy must be considered a fundamental right.

Industry committee  Yes, absolutely. I have a list, in fact. The minister said he wanted to implement four of the recommendations, which leaves 11 of the 15 we put forward. Of those, I mentioned five, in particular. The first recommendation is requiring PIAs for new technologies that can significantly impact Canadians, like generative AI.

Industry committee  I've called it a step in the right direction, so I am encouraged. I see a possibility for further improvements, and those are the 15 recommendations that I am making, but I have said it is a step in the right direction.

Industry committee  Risks to privacy are significant in the context of generative AI. That's certainly my view. It's the view of the G7 ministers. I pointed to a recent report of the OECD in September of this year, in which the OECD canvassed all of the G7 digital and tech ministers about the top risks of AI—not just the risks, but the top benefits as well, because there are benefits in terms of productivity and so on.

Industry committee  With AIDA Canada has the opportunity to be the first. There is legislation is Europe that is moving forward, and that is something that we've pointed out in our submission on Bill C-27. This is a positive step, and Parliament needs to get it right. What I'm highlighting in the context of AI, in particular, is that the AIDA bill would bring in significant proactive risk mitigation measures to deal with harms and biases.

Industry committee  Listing privacy as a fundamental right is certainly part of it and certainly sends the interpretive message about how this is to be treated. Having a privacy impact assessment as an explicit legal requirement is helpful to organizations, because they know what they have to do. We can provide guidance through regulation or through my office, so that industry get this certainty and can thereby know why they're investing resources in doing this.

Industry committee  I view my role and the role of my office as promoting and protecting the fundamental privacy rights of Canadians and being an adviser to you, as parliamentarians, in making the decisions. With this in mind, I've made 15 recommendations. I have communicated this. My office did that, before I was commissioner, with its views.

Industry committee  No, he has not. I have the same information you have, which is the letter that has been tabled at this committee.

Industry committee  I think we do have significant advice that we can offer. The ideal way would be for my office to be consulted as early as possible, as often as possible, with proposed privacy changes. I understand there are some issues about cabinet confidentiality as to what can and cannot be shared, but on the topics that are being considered—the themes, the issues—I agree with you that if we're able to give input at the front end, there's a greater chance for these issues to be resolved.

Industry committee  It should be. This is why I've recommended this explicit recognition. As you know, up until now it was described sometimes as a privacy interest or as a right—there was some more tepid language, I suppose—and my strong recommendation was that we need to make this explicit. We need to recognize it is quasi-constitutional, as courts have said and as the international community has said, so that in the purpose clause—and I recommended adding it in the preamble as well as in the purpose clause, but you're right; the purpose clause is the key—if you use the words “fundamental right”, you are sending a signal to courts, to decision-makers, to me, that even when you are balancing this with other elements, such as the needs of organizations—which have to be considered; we have to have innovation at the same time—if there is a clear conflict, one should prevail, and it is the fundamental right that should prevail.

Industry committee  On this question, Mr. Perkins, the bill was introduced before I was formally in place as Privacy Commissioner. The bill was actually introduced the day the House of Commons approved my proposed appointment as Privacy Commissioner. I was not consulted or involved, certainly, before that with respect to Bill C-27, because I wasn't the commissioner.

Industry committee  I know that there had been ongoing exchanges with my office and the department with respect to privacy matters. I don't know the extent of the details that would have been shared with my office prior to my arrival.

Industry committee  My office made a number of recommendations on the predecessor bill to Bill C-27. One of them included recognizing privacy as a fundamental human right. Some concerns were raised with some of the definitions of things like appropriate purposes or the ways information was conveyed.