44th Parl. 1st Sess.
March 7, 2023 10:00AM
Madam Speaker, I agree with some of the points my colleague made regarding concerns about privacy violations.
It really gets on my nerves too when I am looking at something and suddenly get bombarded with ads. We need laws to deal with that.
Here is my question for my colleague. We need a digital charter and better protection for our private data. Does my colleague think this ought to go to committee for an in-depth study so we can hear from all the relevant experts, make top-to-bottom improvements to the bill and make sure it is airtight?
100 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, that is a good question. The more alarming part is that we get pop-ups, and they mysteriously show up after we have been in a certain place. We can extrapolate that to include testimony we have heard at committee.
These data farms and data-mining operations know how someone will vote before they even know how they are going to vote. That is what leads us to huge concerns around being guided in certain directions to vote, which is really anti-democratic. We believe this bill needs to go back, get rewritten and done right. We have the expertise in this place. The minister across the way just needs to listen.
114 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, we have talked about legitimate interest being an exception of a business being able to use data without permission. Another provision in the act, subsection 15(5), gives a business the ability to do implied consent, which is really consent without consent.
Can you comment on how the Liberals are in the pockets of big tech on that?
60 words
- Hear!
- Rabble!
- add
- star_border
- share
- Mar/7/23 11:53:51 a.m.
- Watch
The hon. member knows that I will not be commenting on anything.
12 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, the evidence that the current government has been in the back pocket of big tech has been there since the member across the way, the member for Vaughan who is not here anymore, was just so obviously supporting Google in all its ambitions.
We all understand that there is interest for data. It is something we need to use, but it needs to be done with proper—
70 words
- Hear!
- Rabble!
- add
- star_border
- share
- Mar/7/23 11:54:22 a.m.
- Watch
We have to resume debate.
The hon. member for Cypress Hills—Grasslands.
13 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, it is an honour to rise once again in this place as we resume debate on Bill C-27, the digital charter implementation act.
During discussion of this bill and related issues, we are not going to get anywhere if we do not start to recognize that privacy is a fundamental right. This is what Conservatives believe and is where we are coming from when we talk about the positive or negative aspects of this piece of legislation. Not only is it true, but it has to be a priority. That is what Canadians expect from us and that is the message we are delivering to the current government. It is also what has been echoed by many of our constituents as we get emails or phone calls from people who are concerned about this bill and about this issue in general.
The world we live in is rapidly changing and the pace of change seems to be getting faster as we go. It is really amazing what people can achieve with digital technology, yet it has also left us in a more vulnerable and insecure position. There are many ways to intrude upon and violate our privacy that did not exist before, and it is safe to say that this trend will continue in the coming years.
If it was not clear already, it is easy to see now that we have to do more than respond to the changes simply as they come. Instead, we need to do our absolute best to think ahead and make sure that our efforts to protect privacy will not become outdated shortly after we pass any kind of bill into law. It is the least we can do if we are serious about preparing our country for the future, but it is true that, before we can do that, we first have some catching up to do.
Our current privacy legislation is long overdue for an update. It has been 22 years since Canada updated its privacy legislation. Twenty-two years ago, the Internet was basically a new phenomenon, and only about half of Canadians were online. Back then, I think Joe Sakic was the MVP of the NHL, and I was only 13 years old, so a lot has changed in that time.
Today, the Internet is a valuable tool used daily by the majority of Canadians. Generally speaking, people basically are living online. We use social media to connect with family, friends and professional networks. We use a GPS to get directions to move from place to place and navigate around our cities and towns. We have online banking to manage our finances. However, at the beginning of the new millennium, pretty much the majority of this was unheard of. In fact, I think we can all remember what we thought was going to potentially happen on Y2K and the implications it was possibly going to have on technology, which thankfully never came to fruition.
It has been years since the Liberals announced a new data strategy for Canada, which also has not become a reality. The promise also came four years after they formed government. It has now been about as long from then until now. After such a long time, Canadians are still waiting for someone to provide higher standards for the use and collection of their personal data.
So much of what we do these days involves an exchange of our data. Facial and fingerprint recognition are used for security, along with our passwords. Digital maps and search functions track our locations in real time. Many of us upload and share an overwhelming amount of personal information on social media accounts and platforms. We are constantly giving our data to different online companies in order to use their services. People feel comfortable enough to do all this because there is a voluntary loss of privacy for the sake of convenience, but this arrangement also requires a deep level of trust. It could not exist otherwise.
Whenever there has been a breach or loss of that trust, the problem of privacy becomes more obvious. There have been organizations exploiting the trust of people to sell their personal information without authorization. In some cases, the data has gone to places that are not working in their best interests.
I am sure, Madam Speaker, like many people in the House, when you go to a website it asks you if you accept the cookies, for example. Obviously, people just accept and go on there because they want to read the articles. What they do not realize is what they are agreeing to when it talks about what is going to happen with their search history or different aspects that might be invaded by those cookies. Therefore, we have to get serious about privacy. We have to mean it when we say that we recognize that privacy is a fundamental right.
The first draft of Bill C-27 says in the preamble, “the protection of the privacy interests of individuals with respect to their personal information is essential to individual autonomy and dignity and to the full enjoyment of fundamental rights and freedoms in Canada”.
Of course, I am not going to disagree with that. I believe it is good for a law to make a statement like this. However, it is also true that we can and should take it a step further in the same direction. Why not have this type of statement included in the text of the bill instead of only in the preamble? That way, it would more likely be stronger for enforcement and interpretation by the courts. With the situation we are in today, it is worth making our privacy law as strong as possible, and this would be a simple way for us to set the right tone. That is something we are calling for.
This is one example, among many, of how Bill C-27 could be improved with some amendments. Conservatives want to make sure we update our legislation in the right way. After all, in this area of privacy, we should not settle for less.
There is more that can be done to fill the gaps in our privacy law. If the government does not accept stronger legislation, it will simply be insufficient. The law must ensure that the privacy of our citizens would be respected by the activities of government and business. Canadians are the owners of their data, and corporations should ask for consent if ever they hope to collect, use or disclose a client's information.
Instead, the Liberal government still has loopholes with respect to privacy. Corporations can still operate with implied consent instead of express consent, which is freely given, specific, informed and unambiguous consent. What happened with Home Depot and Facebook shows how relying on implied consent can go wrong. In this case, a person could ask for email receipts from Home Depot. Their email address, as well as details of their purchase, were given to Meta, which then matched the person with a Facebook or Instagram account.
When brought to court, Home Depot claimed that it had the implied consent of customers to share their emails with whomever it pleased. When I shopped at Home Depot, I never gave my email address to it, but it never once asked me if I was okay with sharing that data with somebody other than for its own transactional purposes.
We have a lack of clarity, which is not protecting the consumer as much it should be. Implied consent has been losing relevance over time. In our context, it creates headaches for customers who are going about their regular business. They expect one thing and later find out that something much different is going on with their personal data. Even if they agreed or simply went along with something, they rightly feel misled by what happened. That is not informed consent. Our peer countries have been moving away from this. Europe's general data protection regulation has been heralded as the gold standard for privacy laws, and it has done away with implied consent.
Going back to discussing Home Depot, it also said that anything people bought there would be classified as “non-sensitive”, which is something this bill fails to define. Vague language will not favour our citizens in the end. With the Home Depot case, we can see that the law could be interpreted by larger organizations to allow them to do what the law actually intended to restrict. We should clearly define “sensitive information”, and it needs to apply to everyone.
Another vague part of this bill is the implementation of the right to disposal. Bill C-27 would allow the user to request that their data be destroyed, but clarification is needed regarding anonymization and the right to delete or the right to vanish.
At the end of the day, this bill is like many announcements the Liberal government likes to make. It sounds good, but the incompetence, the vague language and failure to close loopholes mean that it would not do what it says it would do. However, it should not surprise anybody if a Liberal bill has significant weaknesses and gaps on the issue of privacy. It is hard for Canadians to take the government seriously based on its own record. It has not shown respect for privacy.
We have seen a government agency use location data from cellphones for tracking purposes. We have seen law enforcement access Clearview AI's illegally created facial recognition database, and, of course, last year we saw the public doxing of online donors. While that was happening, the Liberals decided to mess with the bank accounts of Canadians, and some of those people had not even made donations themselves and certainly had not committed crimes.
It is easy for things to go wrong when there is government overreach, but today the federal government has an opportunity to modernize and protect our country for the problems we face in the 2lst century. If it does not listen to us and fails to make the right decisions, it would be truly shameful.
1703 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, I am wondering if the member can enlighten us. He referred to what he believes are shortfalls in the legislation. I would ask him to indicate clearly if he has specific changes he would like to see in the form of an amendment that he believes would enhance the legislation to such a degree that he would be prepared to support it.
64 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, I think a lot of it, too, falls on the vague language that we see throughout the bill. I alluded to that multiple times throughout my speech. Canadians want to see strong safeguards because right now the fact is that there are not as many protections currently in the law, but as this bill is currently written, it would not necessarily strengthen it either. It is good to see that the government has put legislation forward, but at this point it just feels like it is a virtue signal that the government is going to take this issue seriously, but it is not actually doing anything substantive to it.
Conservatives want the bill to have stronger language to make sure there would be real rules in place to protect people's data and make sure they would not be victimized either by big government or big business.
149 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, I am wondering about something. People have been talking about anonymizing data and the importance of protecting individuals' personal information by keeping it anonymous.
That said, we will be working on the online hate issue shortly. I think that, in some cases, we do need that ability to trace Internet users so we can pass legislation and take action if people make statements that cross the line and are found to be illegal or even criminal.
Does my colleague think it is possible to protect personal information and anonymize data online while also keeping Quebeckers and Canadians safe by making sure users who commit online crimes can be traced?
111 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, I think anonymizing and aggregating data is extremely important. One example we saw where that was not necessarily taking place was with Tim Hortons. A couple of years ago, if someone had the app and was going to the store to buy a product, or if they just had it on their phone and went through there, Tim Hortons would track where people were going for a period of time after they had been at the store. It was very clear where that data was going and what it was going to be used for, because it was not anonymized or aggregated.
I do think there is something to be said for having a proper regime in place to make anonymization and aggregation take place. It does happen in some cases, but I think it needs to be utilized a lot more in cases where people's data is there. People need to know for sure, have absolute confidence, that it will be done and that the data cannot be unscrambled. We have heard many times in other committees that the unscrambling of data can happen and that it can happen quite quickly too, so we need to make sure people are protected, even if their data is being anonymized and aggregated.
214 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, I think one of the things we have really benefited from in Canada is the Privacy Commissioner and the office. There is no doubt that the United States not having this position has created an issue for that country. For ourselves, the commission having appropriate resources and reformation to enforce the decisions, as well as having independence from Parliament in many respects, is crucial for the NDP.
I am just wondering where the Conservatives stand on this, with regard to the Privacy Commission, because there would potentially be a tribunal created with Bill C-27, and then there would be far more regulation and oversight necessary from the Privacy Commissioner in the age of artificial intelligence.
118 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, having the Privacy Commissioner is fantastic, and it is interesting to see provinces that have their own privacy commissioners as well. For a number of meetings, I substituted in on the ethics committee, and we heard from some of the provincial privacy commissioners who did fantastic and important work. I think, generally speaking, Canadians would like to see them continue to be able to do their work. They play an important role. I am only going to talk about what is happening here in Canada, but I would like to see their offices continue to function, and I appreciate the valuable work they do.
106 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, we are talking about Bill C-27, an act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other acts. The length of the bill's title is commensurate with the work that will be required of legislators.
Obviously, the Bloc Québécois will be voting in favour of the bill, since we have wanted it for quite some time. Quebec is actually already ahead of the curve on this issue. We absolutely must send Bill C-27 to committee so we can hear from experts who will point out the flaws in the bill, shed light on how to improve it and put some flesh on the bones, so to speak.
There are too many details in terms of the areas of action and application, and we cannot look at them all too quickly. We need some clarification, and that is to be expected. The committee needs to hear from a wide range of witnesses. The bill must not pass too quickly. What matters is taking our time in committee. That is what taking responsibility looks like, if we want Internet users to do the same.
On November 28, 2022, the Speaker of the House made the following decision regarding Bill C‑27:
...two votes will take place at the second reading stage.... The first will be on parts 1 and 2, including the schedule to clause 2. The second will deal with part 3 of the bill.
Thus, if the House votes against the AI portion, work on Bill C‑27 will continue without that portion. If the House votes in favour of the bill in its entirety, it will go to committee. Even if we vote in favour of the AI portion at second reading, there is still an opportunity to vote against it at third reading. That sort of latitude is important.
The Personal Information Protection and Electronic Documents Act has needed reform for years. A digital charter is urgently needed. Canada's privacy law is pre-digital, if not prehistoric. Today's context is completely different from that of the 2000s.
Bill C‑27 is also a response to the strict and ambitious European privacy legislation, the General Data Protection Regulation. We already know that without an adequate legislative response, it will become impossible for European organizations to exchange information with countries or international organizations that have not adopted legislation as strict as theirs.
If Bill C‑27 is not well structured and up to date, Canada will not meet the European Union's expectations. I consider that to be important and very serious.
In Canada, the financial sector is beginning to worry, and it is putting pressure on the government because it fears losing a portion of its European market. That makes sense.
There is less pressure in Quebec because our laws are already compliant, or almost. What is governed by Quebec is already relatively protected. The problem is when two levels of government overlap and one is inadequate. For example, Mouvement Desjardins is already prepared, but the same cannot be said for Fiducie Desjardins, which is the Ontario counterpart. It is the former Trust Royal, an Ontario trust company.
It is troubling, for example, that Ontario does not have updated privacy and artificial intelligence legislation when we do and that even the same institutions with the same names do not have the same laws.
However, even though this is an urgent issue, we cannot take a scattershot approach and let the most important things get lost in the shuffle.
Let us talk about protecting individuals. In many ways, Bill C‑27 seeks to protect individuals' anonymity. It puts the individual and the idea of consent back at the centre of reflections on digital exchanges. To date, in Canada, organizations have been given a free pass and they have taken advantage of the digital wild west to share personal information without any legislation to stem their greed. Bill C‑27 will not only limit and restrict their excessive freedom, but it will also give them responsibilities.
Bill C‑27 creates a tribunal. It sets out three types of sanctions for those who contravene the act. The first is administrative monetary penalties, or fines, which work for road violations, at least. The other two are criminal and penal offences.
Bill C‑27 is clearly binding and it has real power.
Privacy protection is a shared jurisdiction. Even if Bill C‑27 gives the impression that it will be consistent with Quebec's new Bill 25 on privacy protection, as currently drafted it offers no such guarantee. The government must ensure that Bill 25 is substantially similar to Bill C‑27 and stipulate it by decree. We understand that Bill C‑27 is not intended to infringe on Quebec's legislation. This needs to be confirmed in committee.
Let us now talk about artificial intelligence, more specifically about individual identification. There are currently three ways to identify an individual, either with a password or social insurance number, biometric data and voice recognition and our possessions, such as text messages, phone calls and so forth.
Currently, European law requires companies to rely on two of those ways, and maybe three, eventually. Bill C‑27 needs to legislate on this as well.
There is also the variable of sensitive personal information. Inspired by European law, Quebec's Bill 25 on privacy protection defines information as sensitive if “due to its nature or the context of its use or communication, it entails a high level of reasonable expectation of privacy.”
On that point, although Bill C-27 does not define what sensitive data is, its meaning will guide the development of cybersecurity measures. In other words, the AI legislation enacted in Bill C-27 will serve as the foundation upon which more ambitious legislation will have to be built so that we can more adequately regulate the AI environment. It is a good start, albeit a late one.
In closing, I would point to the many feats of artificial intelligence. This is a process of imitating human intelligence that relies on creating and applying algorithms in a dynamic computing environment. We have all seen the Prime Minister responding in a fake interview where he can be heard making false statements. The sound and image were really similar. It was uncanny.
It has also been shown that artificial intelligence can create works of art whose similarities are so close to the original creation that they could compromise its original value. I am a songwriter, and, thanks to the ChatGPT concept, one could take the various characteristics of each of my 80 original songs and make an 81st that would have essentially the same melodic flourishes and the same kinds of metaphors. I confess that this troubles me immensely.
We all understand the potential scale of this kind of thing and how it can have all kinds of repercussions. However, we have also been told that, for science, this tool can be revolutionary as long as we have a legislative framework that is adapted to the current state of AI and future-proofed for developments to come. What worries us is the minister's stated intention to pass the bill quickly. Bloc members believe the committee should take all the time it needs to hear from a broad range of witnesses so we can identify and fix the bill's grey areas and blind spots.
The government indicated openness to slowing the work down. Will it do as we ask? We hope so. If that is how it works out, that would be good.
AI is more about the data analysis process and the ability to do that thoroughly than about a particular format or function. That is why we have to deal with the issue carefully and understand its impact so we can make the necessary legal framework as good as possible. Doing that means taking the time for an in-depth study of Bill C‑27.
Here again, Quebec is the leader of the pack, and others would do well to follow suit.
1390 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, I appreciate the work that my colleague does with me on the Standing Committee on Fisheries and Oceans.
As my colleague knows, I have three young children, aged seven, eight and 10. Sometimes, when I see them using their devices, I think about how much things have changed from when I was their age. I would like to ask my colleague whether she thinks it is important that this bill makes it possible to protect children and set up parental controls to keep our children safe from everything that is on the Internet and social media, so that they are protected from data theft and identity theft.
109 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, I thank my colleague. I admire him and appreciate his friendship because we work very well together in committee. We have a great connection and I appreciate that.
I also appreciate the fact that his wife is a music creator like me. She knows what I mean when I talk about the threat of our artistic productions being copied.
With regard to cybersecurity for children, I completely agree with my colleague. I think that the committee will be very interested in examining that unique aspect of the bill. We talked about cyberviolence yesterday, and I think that will be an extremely important aspect. We also need to think about educating families and parents so they get the tools they need to better protect our young children, who certainly need protecting in today's tumultuous cyber-environment.
138 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, my colleague is probably hearing from constituents, as I am. The bill seems to be silent on the selling of personal data. It is silent on facial recognition. She mentioned the artificial intelligence part of it. It seems that the new artificial intelligence part of it was just jammed alongside, and there is not a lot of thought in there.
She did not comment on the concept of implied consent. I thank my Liberal colleague for bringing up the protection issues. The bill does mention the term “implied consent”. That would allow businesses to take a user's consent to use their data and information for new purposes without actually obtaining it. I wonder if she could comment on that and why it is so important to get that right.
134 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, I thank my colleague for his very relevant question. When it comes to consent, I believe that very clear guidelines need to be set in order to avoid ambiguity.
Why does the bill before us need so much study and deliberation in committee?
I think we will find that consent is a very particular aspect of this domain and that, as I said, we will have to set very clear and precise guidelines that cannot fail in practice. I believe the experts will enlighten us on this subject. I hope we will have the ability and the opportunity to hear from them during the committee study.
108 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, it is an important piece to talk about. Megacorporations, in particular those corporations that utilize AI and other digital tools, have been doing something nefarious, which is putting in these long, giant legal descriptions. Many people just scroll to the bottom of these and accept them. However, many people do not know how complicated those arrangements are that they are coming into.
I wonder if the member would talk about how dangerous it is to have such complicated agreements that regular folks are signing on to, while not knowing the explicit dangers and damages that come along with agreeing to those terms and conditions, like the ones we are talking about today and like the ones that are harvesting data. Would the member expand on that, please?
129 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, I will give a brief answer.
Cigarette packs have a warning label on them to indicate that smoking causes cancer. I think it will be important to include similar warnings about the security of our personal data on the Internet.
42 words
- Hear!
- Rabble!
- add
- star_border
- share
- menumenu
- notificationsnotifications
- home
- mailmail
- searchsearch
