44th Parl. 1st Sess.
November 28, 2022 11:00AM
Madam Speaker, as part of the ethics committee team, I have already begun these deep-dive discussions on the impact of AI on privacy. We have looked at the mobility data of movement as it pertained to the pandemic. I can rest assured that I have an interest in this at committee, whether it is at ethics, at justice or wherever this lands, to make sure that we get those answers. Consumers and Canadians have a right to know how their data is used and to understand when it is used and the purpose for it.
I am deeply encouraged by our work at committee and what we have done, and I look forward to the discussions that will be ahead.
121 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, privacy rights are so critical. When they are violated, consumers deserve to be compensated. There have been numerous examples in the United States where consumers have been compensated in the realm of hundreds of millions of dollars. For the same breach here in Canada, consumers have not been compensated.
I am wondering if the member would support amendments that would ensure that, in Bill C-27, there is parity, and for the same breach, Canadians and Americans would be getting fair compensation.
84 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, as I mentioned in my speech, part of the act and its contemplation is financial consequences for misuse of the act, in terms of privacy and data breaches, so it is certainly something that would come up.
I heed warning. The member and I have talked about this in terms of the Volkswagen case in the U.S. and Canada. We need to compare apples to apples. It is a bit of apples to oranges when it comes to the litigious nature of the United States in terms of compensation and the guardrails that are here in Canada. We should always be mindful of that. While in principle we want to make sure that there is accountability and transparency in the use of this, and that with accountability comes financial penalties, I would like to make sure that it is a made-in-Canada approach.
147 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, data is used for good and data is used for evil. Data is money, data is power and data is knowledge. Data can improve our lives. Data can also harm our lives. Data tells the story of our lives, and our personal data flows globally. The amount of data in the world has doubled since 2020 and is expected to triple by 2025 according to Statista, 2022.
To understand why we need modern privacy rights in the digital world, it is important to understand that businesses have evolved from providing a specific service, like a social network such as Facebook and Twitter or a search engines such as Google or Microsoft to find things, to using data to gather information on individuals and groups, to manage and deploy people's data and to sell their information to others and sell them goods and services.
We have evolved from businesses providing these services for interest to businesses using these services for surveillance on us and making enormous amounts of money on our personal information. As legislators, we must balance the uses of data collection with an individual's right to privacy. It is a delicate balance that Bill C-27 aims to address by modernizing our privacy laws.
At the heart of this long overdue revision to our privacy laws must be the rights of the individual. In my view, commercial usage of data under privacy law should be secondary to personal privacy, and should only be focused on how business interests enhance personal needs and how commercial entities protect individual privacy rights. My remarks today will focus on why this legislation falls far short of what individuals, groups and businesses need for a clear legislative framework of data collection and management of personal information in this digital age.
First, Bill C-27 is really three bills in one omnibus bill. The first bill would update privacy law. The second bill contains a new semi-judicial body and would potentially duplicate what the Privacy Commissioner could do while removing the right to go to the courts. The third is a rushed bolt-on bill on artificial intelligence that does not, in my mind, have much intelligence in it. The Liberal legislation manages to weaken privacy and put up barriers to innovation at the same time.
Bill C-27 fails Canadians right up front in its preamble. Despite demands from privacy advocates over the last few years, the government has failed to recognize privacy as a fundamental right in the preamble. The bill states that individuals' personal information should have the “full enjoyment of fundamental rights”. This is clever language that avoids giving personal privacy the recognition that it is a fundamental right or a fundamental human right.
The wording “full enjoyment of fundamental rights” in the preamble needs to be amended from “of fundamental rights” to “as a fundamental right”. Furthermore, leaving this strictly in the preamble reduces if not eliminates any real legal impact. If privacy is a fundamental right, for it to have true force in this bill it needs to be included as well in clause 5, which notes the purpose of the bill.
Why is privacy a fundamental right? Freedom of thought, freedom of speech and freedom to be left alone are derived from privacy. The legal protections of privacy limit government's intrusion into our lives. In free and democratic societies, we consider these freedoms as essential rights. The rights to think what I want, to say what I want and to be free to choose what I do, what I am interested in and whom I interact with and where I do that in our digital world are data points. To me they are personal information and therefore are part of a fundamental right to privacy.
What does this mean? It means privacy rights under law are prioritized over commercial rights. A rights-based approach serves as an effective check on technology's potential dangers while ensuring businesses can function and thrive.
Government officials have told me this cannot be recognized in the bill the way it needs to be to have true meaning under law and force because it would intrude on provincial jurisdiction. I do not agree, and neither does the Privacy Commissioner of Canada. Both levels of government can regulate privacy and do. The federal government's role is to regulate aspects under its control, including the fact that commerce does not follow provincial boundaries and therefore requires federal oversight.
I believe that most Canadians accept and expect their data to be used to enhance their experiences and needs in our modern society. I also believe that for organizations to obtain the data of Canadians, Canadians must first consent to it, and that if these same organizations find new uses of our data, they need to get express consent as well. Canadians want their data safely protected and not used for things they did not give permission for, and if they choose to end a relationship with a service provider, they want their personal data to be destroyed.
I do not believe Canadians want their personal data sold to other entities without their express consent, and how does Bill C-27 deal with these expectations of Canadians? I think poorly. The legislation, in the summary section, states that the dual purpose of the bill is to “govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities.” What it would not do is place personal privacy rights above commercial interests.
The bill would require express consent in clause 15, and that is true, but a great deal of the bill goes on to describe the many ways in which consent would not be required and how it would be left up to the discretion of the organization that has collected the data if it needs consent for its usage. The bill is also weak in terms of making sure individuals understand consent when given. For consent to be meaningful, the usages proposed must be understood. The lack of definition and the placement of burden of interpretation on businesses expose those same businesses to legal action and penalties if they get it wrong. This lack of clarity may stifle innovation in Canada as a result. The bill needs to ensure that individuals understand the nature, purpose and consequences of the collection, use and disclosure of the information to which they are consenting.
In addition, the bill would give organizations the right to use information in new ways and would require businesses to get an update to consent for this information. That is good and necessary, but the bill would also enable organizations to use the implied consent in subclause 15(5). When combined with paragraph 18(2)(d), this would give businesses carte blanche to use implied consent rather than express consent.
An organization can decide on its own that the original consent implies consent for a new purpose, and they do not need to seek the individual's views. This is a version of the old negative option marketing that was outlawed in the 1990s. Either someone gives consent, or they do not. There is no such thing as implied consent, in my view, and this needs to be removed from the bill.
Additionally, the bill uses the term “sensitive information”, which companies and organizations must determine to protect data, but it does not anywhere in the more than 100 pages define what “sensitive information” is. It needs to be defined in the bill to include information revealing racial and ethnic origin, gender identity, sexual orientation and religious and other affiliations. These are just a few examples.
However, that is not the worst of it. Bill C-27 would introduce a concept called “legitimate interest”. This is a new rule that would rank an individual's interests and fundamental rights below those of the organization that gathered the information, the exact opposite of what a personal privacy bill should do. To do this, subclause 18(3) would allow an organization or business to use information if it has a legitimate interest in doing so. However, here is where it really gets goofy: To try to reduce businesses using our data under the legitimate interest clause for their own needs over ours, the Liberals have decided to limit the power under paragraph 18(3)(b). This clause could prohibit the business or organization from using our information for the purpose of influencing behaviour.
For more than 20 years, since the invention of loyalty and rewards programs, retailers have used people's data to offer products they might enjoy based on their purchasing patterns. Have members ever bought wine online or in store because it said, “If you like this, you might enjoy this alternative”? Have members ever watched a show on Netflix because it was recommended? Have members ever listened to a song on Spotify because it was recommended based on what else they had listened to? Well, guess what. Paragraph 18(3)(b) could now make this service illegal.
The Liberals cannot get express consent right, and they are allowing companies to use people's data with implied consent or no consent at all. The Liberals are also putting the business use of people's personal data above their privacy rights. That is why it is really the no privacy bill. At the same time, the Liberals are making illegal the good parts of what businesses do in enhancing the customer experience by removing the ability to study purchasing patterns and offering products that we might enjoy because of paragraph 18(3)(b). This bill makes influencing people's decisions illegal.
The minister said to me and mentioned in the House in his opening speech on the bill, as have other members today, that he is proud to be protecting children from harm in this digital bill. This 100-page legislation has only one clause related to children. Subclause 2(2), under “Definitions”, states that “information of minors is considered to be sensitive”, but the bill does not define “sensitive” nor does it define what a minor is. Officials tell me that the definition of a minor is determined by provincial law, so each province would have different rules, and companies would have to comply with the different rules in every province.
If the protection of children were really a major purpose, this legislation would devote some space to defining both what a minor is and what sensitive information is. During COVID, minors used many online apps and programs to continue their formal education. There were then and still are no protections under law as to what is done with their data. This technology would be a new normal for our education system. The online surveillance of children resulting from the COVID experience is huge and protections are zero, even with this bill.
This bill needs to define in law, not regulation, age-appropriate consent for minors, and comprehensive rules to prevent the collection, manipulation and use of any minor's data. This bill leaves it up to businesses to decide what is sensitive and appropriate for minors. It is a colossal failure on the minister's main selling point for this no privacy bill.
The bill is silent on the selling of personal data. It needs provisions on the limits and obligations of data brokers. The bill is silent on the use of facial recognition technology. The bill also prohibits using data in a way that produces significant harm and defines it inadequately. For example, psychological harm caused by a data breach and embarrassment caused by privacy loss are not included. The damages role needs to be expanded to include moral damages, since most contraventions of privacy do not involve provable, quantifiable damages.
Creating more government bureaucracy and growth is the true legacy of the Liberals in government. This bill is no exception, with the creation of a body to appeal the Privacy Commissioner's rulings to. The appointed new body of non-lawyers is called the personal protection and data tribunal, and it is the second part of the bill. Frankly, these powers, if they really are important, should be given to the Privacy Commissioner to eliminate the middle man of bureaucracy. There is no need for this tribunal.
Finally, let us turn to the ill-conceived, poorly structured and ill-defined artificial intelligence part of Bill C-27. It really needs to be removed from this legislation and puts this bill's passage into question. AI is a valid area to legislate, but only with a bill that has a legislative goal. That is why I am hopeful that the Speaker will rule in favour of the NDP's point of order, reiterated by our Conservative House leader, which would ensure that part 3 of the bill is voted on separately from part 1 and part 2.
Essentially, this part of Bill C-27 would drive all work on AI out of Canada to countries with clearer government legislation. It tells me the government has not done its homework, does not really know what AI is or will become, and has no idea how it will impact people in our country.
The bill asks parliamentarians to pass a law that defines no goals or oversight and would give all future law-making power to the minister through regulation, not even to the Governor in Council but to the minister. The minister can make law, investigate violations, determine guilt and impose penalties without ever going to Parliament, cabinet or any third party.
It is a massive overreach and is anti-democratic in an area critical to Canada's innovation agenda. Promises of consultation in the process of crafting regulations is too little, too late. It puts too much power in the hands of unelected officials and the minister.
The definition in the bill of what AI is, and therefore what it wants total regulatory power over, is a system that autonomously processes date related to human activities using a genetic algorithm, a neural network, machine learning or other networks to make recommendations or predictions. If we think this is futuristic, it is not. It is already happening in warfare to determine and execute bombings.
Without parliamentary oversight, the bill introduces the concept of “high-impact systems”. It does not define what that is, but it will be defined in regulation and managed in regulation. No regulatory power should ever be given to the minister or the Governor in Council for anything that is not defined in law.
The only thing the bill defines is the unprecedented power to rule all over this industry and the fines to those who breach the unwritten regulations. The massive financial and jail penalties that extend down to the developers and the university researchers for undefined breaches of law as part of the statute are huge.
Unless this portion of the bill is separated when members vote, this AI section is reason alone that the bill should be defeated. AI is a significant need, but it needs a proper legislative framework, one that is actually developed with consultation.
I urge all members to read the bill carefully. Current privacy laws need amendment, but the current law is preferable to this ill-defined proposal. The AI bill would drive innovation and business out of Canada's economy, making us less competitive.
It is hard to believe anyone could get this legislation so wrong, especially since this is the second time the Liberals have proposed updating our privacy laws. Without splitting the bill, without having separate votes and without considerable amendments in committee in the first two parts, the bill should be defeated.
I urge all members to consider this seriously in their deliberations as we go on to the many speeches that we will hear. While this is a critical point of updating our personal privacy, the bill, in its current state, does not do it and it gives equal if not greater rights to businesses and organizations than it does to individuals.
2723 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, I have heard the Conservatives talk a couple times, as did the member, about the definition of a “minor”. For a lot of people, that is self-explanatory. I think we can assume what is intended by the definition of “minor”. Would the member support this going to committee so questions like that could be answered? If it is a matter of defining that, and the member and others feel so passionately that it should be in there, would it not be beneficial to get it to committee so that discussion could be had?
100 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, I suspect the bill will go to committee given the costly coalition of the NDP and Liberals.
Specifically on that question on defining “minors”, it is not clear in the bill because it does not set an age. We are allowed to drive at 16 and vote at 18. The age of majority can be 19 for consuming alcohol. In the United States, the law for the purpose of the digital economy, I think, defines it as low as 13. That is where some of the confusion will lie.
If people are running businesses and we have all these different definitions in Canada of what a minor is, how are they supposed to determine, for the purpose of managing that database and whether that information should stay there or not, what the cut-off age is? It is too vague.
I am hopeful that is one of the areas, presuming the bill will reach committee with the coalition, that we will study in depth and perhaps be able to come up with a more precise definition.
180 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, I thank my colleague from South Shore—St. Margarets for her speech.
Here are my takeaways from my colleague's speech: Not everything in this bill is black and white, and it could be improved. Also, the Conservatives want to vote against the bill just to prevent it from going to committee. In contrast, I think we can find common ground and amend it.
I have to say that this unwillingness to send the bill to committee does suggest, kind of like what we saw with the bill to amend the Broadcasting Act, that the Conservatives may be under the influence of big corporations that would be happier with no regulatory framework whatsoever rather than an imperfect one that is a work in progress.
I think this kind of approach which consists of arguing against sending the bill to committee could undermine Quebeckers' and Canadians' confidence in our institutions.
152 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, the member for Mirabel and I have some spirited discussions as seatmates.
With respect to the first point, if there is not a separate vote, as has been requested in the point of order, for the artificial intelligence in the third part of the bill, then, yes, we agree that this needs to be defeated because it would really hurt our economy.
In terms of the issue of personal privacy versus companies, in my remarks I made it very clear that the bill is inadequate in dealing with the personal protection of privacy and data of the individual and it places the interest of business over that. We are opposed to this.
114 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, I share my colleague's concern about the lack of due diligence on the artificial intelligence aspect of the bill. I wonder if the member wants to elaborate on that point a bit more, because artificial intelligence could be anywhere from national defence all the way to something as simple as products people have in their homes. I wonder if the member wants to talk a bit more about the importance of separating that part of the bill.
80 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, it is an enormous area. Artificial intelligence is already here in aspects of our lives of which we are not aware. Machine learning has evolved into this neural net.
There was a conflict in Azerbaijan where all the targets were chosen by artificial intelligence and the actual bombing and execution of that were all done by artificial intelligence without any human intervention. Obviously that is a worrisome thing from our perspective, though maybe not from some perspectives of other countries with different ethical backgrounds or approaches to these issues.
There is the need to do a proper consultation beforehand. We are at the early stages of trying to figure out the balance of how to do that in a way that still enhances our lives, like those things that we get now through machine learning about better purchasing options, right through to the issue of the point of which the machines are doing the decision-making process. It is an important area to put some regulatory and law structure around, as other countries have. However, we need to have much more detail in the bill rather than just give the minister carte blanche of regulatory power in the future to define it, execute it and investigate it.
209 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, one of the concerns I have with the bill is again with respect to companies having too many rights and too much power within this. One of them is around the disposal of information. Could the member talk about his party's concern with that as well, when companies say that they are disposing of it and yet that information is truly not disposable?
66 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, that is a great question regarding the ability of individuals to request the destruction, for example, of their data if they leave. I heard about a case in the news this morning and I got an email from somebody yesterday, who has been having this ongoing battle with Telus. The person is leaving the company and wants that information destroyed, but cannot even get a response from Telus.
That is one of the areas, if the bill gets to committee, that we need to explore the issue of providing amendments to the bill that would give individuals more control over the decision to destroy their data if they leave.
There is a worrying provision, as I mentioned already, about minors. A member of the government side said that minors could request the destruction of their data. I do not think minors should have to request it, personally. Minors' data should not be kept in anyway in storage in the system we have today.
165 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, on that point, when we think about data that is collected, quite often a lot of that data, especially by AI, is collected in a manner that is not identifiable with who the data came from. The whole point to AI is to develop the systems by pouring massive amounts of data into them so the technology can become intelligence, so to speak.
How does the member square the comment he made with respect to demanding data be deleted from Telus, for example, when it might not be identifiable and, ultimately, one would not want it to necessarily be identifiable in many situations? Would he exclude that from those comments?
112 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, all information is identifiable because it involves, and should involve, expressed consent up front and is trackable under all systems now, even under AI. It can be, theoretically, and at times the identity is removed to put it together in a larger context of data.
I am looking forward to hearing testimony on this. It is my understanding that there are technologies that allow people, through a back end, to figure out and get at that data. I am not sure the legislation is strong enough to deal with the issue of the itemized data, the stuff that had people's individual identification taken off, and that it cannot be reconstituted. I know there are penalties in the bill for doing that if it is done without permission, but there are questions around the technology's ability to truly hide one's data at this point.
148 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, it is an honour today to rise to speak to Bill C-27, the digital charter implementation act.
I think it is important to reflect on how long it has been since we last had an update to legislation regarding the privacy laws that exist around data. The last time was over 20 years ago. Twenty years might not seem like a long time, but when we think about it, 20 years ago Facebook was probably just a program Mark Zuckerberg was working on in his dorm room.
If we think of iPhones, they were pretty much non-existent 20 years ago. Smart phones were out, but they certainly did not have anywhere near the capabilities they do today. So many other technologies we have come to rely on now have been getting smarter over the years. They are acting in different manners and are able to do the work they do because of the data being collected from individual users.
Another great example would be Google. Twenty years ago it was nothing more than literally a search engine. One had to type into the Google form what one was looking for. Sometimes one had to put weird characters or a plus symbol between words in the search terms. It literally was just a table of contents accessing information for people. However, now it is so much more than that. How many of us have, at some point, said to somebody that we would love to get a new air fryer, and then suddenly, the next day or later that day, we see in Google, on Facebook, or whatever it might be, advertisements for air fryers that keep popping up. I am sure that sometimes it is a coincidence, but I know in my experience it seems it happens way too often to be a coincidence.
These are the results of new technologies that are coming along, and in particular AI, that are able to work algorithms and build new ones based on the information being fed into the system. Of course the more information that gets fed in, the smarter the technologies get and the more they are looking to feed off new data that can give them even further precision with respect to advertising and targeting tools at people.
This is not just about selling advertising. AI can also lead to incredible advancements in technology that we otherwise would not have been able to get to, such as advancements in health and the automotive industry. If we think of our vehicles, the big thing now in new cars is the lane-assist feature, which uses technology such as lidar to read signals in the road.
There is technology that, when we enter our passwords to confirm we are human beings, sometimes requires us to pick different things from pictures. When we do that, we are feeding information back into helping those images be properly placed. We are not just confirming that we are human beings; there is an incredible amount of data being used to give better evaluations to various different formulas and equations based on the things we do.
When we think of things like intelligent and autonomous vehicles, which basically drive themselves, 20 years ago would we ever have thought a car could actually drive itself? We are pretty much halfway there. We are at a point where vehicles are able to see and identify roads and know where they need to be, what the hazards are, and what the possible threats are that exist with respect to that drive.
What is more important is that, when I get into my vehicle, drive it around and engage with other vehicles, it is analyzing all of this data and sending that information back to help develop that AI system for intelligent vehicles to make it even better and more predictive. It is not just the data that goes into the AI, but also the data that it can generate and then further feed to the algorithms to make it even better.
It is very obvious that things have changed quite a bit in 20 years. We are nowhere near where we were 20 years ago. We are so much further ahead, but we have to be conscious of what is happening to that data we are submitting. Sometimes, as I mentioned in a previous question, it can be data that is submitted anonymously for the purposes of being used to help algorithms around lidar and self-driving vehicles, for example. At other times it can be data that can be used for commercial, marketing and advertising purposes.
I think of my children. My six-year-old, who is in grade one, is developing his reading quite quickly. Two years ago, even at the age of four, when he would be playing a video game and would not be able to figure out how to get past a certain level, he would walk up to my wife's iPad and basically say, “Hey, Siri, how do I do this?”
Just saying that, I probably set off a bunch of phones to listen to what I am saying, but the point is that we have children who, already at such a young age, are using this technology. I did not grow up being able to say, “Hey, Siri, how do I do this or that?”
What we have to be really concerned about is the development of children and the development of minors, what they are doing and how that can impact them and their privacy. I am very relieved to see there is a big component of this that, in my opinion, aims to ensure the privacy of minors is maintained, even though I have heard the concern or the criticism from some members today that the definition of “minor” needs to be better reflected in the legislation.
I feel as though if it is not known what a minor is, in terms of how it relates to this legislation, then I believe this is something that can be worked out in committee. It is something to which the governing members would be more than welcome, in terms of listening to the discussion around that and why or why not further clarifying the definition is important.
I would like to just back up a second and talk more specifically about the three parts of this bill and what they would do. The summary reads as follows:
Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities.
A consequence of this first part would be to repeal other older pieces of legislation. I think this is absolutely critical, because this goes back to what I have been talking about in terms of how things have changed over the last 20 years. We are now at a place where we really do not know what information we are giving or is being used from us. I realize, as some other colleagues have indicated, 99.9% of the time, we always click that “yes, I accept the terms” without reading the terms and conditions, not knowing exactly how our information is being used and what is actually being linked directly back to us.
Through the consumer privacy protection act, there would be protections in place for the personal information of individuals while, at the same time, really respecting the need to ensure companies can still innovate, because it is important to innovate. It is important to see these technologies do better.
Quite frankly, it is important for me personally, and this will be very selfish of me, that, when I am watching on Netflix a show that I really like, I get recommendations of other shows I might really like. As the member for South Shore—St. Margarets mentioned earlier, when it comes to Spotify, it is important to me also that, when I start listening to certain music, other music gets suggested to me based on what other people who share similar interests to mine have liked, and how these algorithms end up generating that content for me.
It is important to ensure that companies, if we want them to continue to innovate on these incredible technologies we have, can have access to data. However, it is even more important that they be responsible with respect to that innovation. There has to be the proper balance between privacy and innovation, how people are innovating and how that data is being used.
We have seen examples in recent years, whether in the United States or in Canada, where data that has been collected has been used in a manner not in keeping with how that data was supposed to be used. There has to be a comprehensive act in place that properly identifies how that data is going to be used, because, quite frankly, the last time this legislation was updated, 20 years ago, we had no idea how that data would be used today.
By encouraging responsible innovation and ensuring we have the proper terminology in the legislation, companies would know exactly what they should and should not be doing, how they should be engaging with that data, what they need to do with that data at various times, how to keep it secure and safe and, most importantly, how to maintain the privacy of individuals. It is to the benefit not just of individuals in 2022, or 2023 almost, to have data that is being properly secured. It is also very important and to the benefit of the businesses, so that they know what the rules are and what the playing field is like when it comes to accessing that data.
The second part of this bill, as has been mentioned:
...enacts the Personal Information and Data Protection Tribunal Act, which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act.
This is absolutely critical, because there has to be somewhere people can go to ensure that, if they have a concern from a consumer perspective over the way their data is used and they are not happy with the result from the commissioner, they have an avenue to appeal those decisions. If we do not do that, and we put too much power in the hands of a few individuals, or in this case the Privacy Commissioner under the consumer protection act, if we give all that power and do not have the ability for an appeal mechanism, then we will certainly run into problems down the road. This legislation would help ensure that the commissioner is kept in check, and it would also help consumers have the faith they need to have in terms of accountability when it comes to their data and whether it is being used and maintained in a safe way.
The third part of the bill is the more controversial in terms of whether or not it should be part of this particular legislation or in a separate vote. The summary reads:
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate the risks of harm and biased output related to high-impact artificial intelligence systems.
That act would provide for public reporting and authorizes the minister to order the production of records related to artificial intelligence systems. The act also would establish prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system in an intentional or reckless way that causes material harm to individuals.
One of the consequences of artificial intelligence, quite frankly, is that if we allow all of this biased information to be fed into the artificial intelligence systems and be used to create and produce results for important algorithms, then we run the risk of those results being biased as well if the inputs are going to be that way. Therefore, ensuring that there are proper measures in place to ensure individuals are not going to be treated in a biased manner is going to require true accountability.
The reality is that artificial intelligence, even in its current form, is very hard to predict. It is very hard to understand exactly when a person is being impacted by something being generated from an artificially intelligent form. Quite often, a lot of the interactions we already have on a day-to-day basis are based on these artificial intelligence features that are using various different inputs in order to determine what we should be doing or how we should be engaging with something.
The reality is that if this is done in a biased manner or in a manner that is intentionally reckless, people might not be aware of that until it is well past the point, so it is important to ensure that we have all of the proper measures in place to protect individuals against those who would try to use artificial intelligence in a manner that would intentionally harm them.
As I come to the conclusion of my remarks, I will go back to what I talked about in the beginning, that artificial intelligence, quite frankly, has a lot of benefits to it. It is going to transform just about everything in our lives: how we interact with individuals, how we interact with technologies, how we are cared for, how we move around by transportation, how we make decisions, as we already know, on what to listen to or what to watch.
It is incredibly important that as this technology develops and artificial intelligence becomes more and more common, we ensure that we are in the driver's seat in terms of understanding what is going into that and making sure we are fully aware of anybody who might be breaking rules as they relate to the use of artificial intelligence. It will become more difficult, quite frankly, as the artificial intelligence forms take on new responsibilities and meanings to create new decisions and outputs, and we must ensure that we are in a position to always be in the driver's seat and have the proper oversight that is required.
I recognize that some concerns have been brought forward today by different members. At first glance, when the member for South Shore—St. Margarets and others brought forward the concern around the definition of a “minor”, which is not something I thought of when I originally looked at this bill, I can appreciate, especially after hearing his response to my question, why it is necessary to put a proper definition in there. I hope the bill gets to committee and the committee can study some of those important questions so we can keep moving this along.
I certainly do not feel as though we should just be abandoning this bill altogether because we might have concerns about one thing or another. The reality, and what we know for certain, is that things have changed quite a bit in the last 20 years since the legislation was last updated. We need to start working on this now. We need to get it to committee, and the proper studies need to occur at this point so we can properly ensure that individuals' privacy and protection are taken care of as they relate to the three particular parts I talked about today.
2637 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, the member mentioned some of the things that are missing in the bill and that it will hopefully get to committee, but there was no mention, as he said, about minors and defining “minor”. My other colleague mentioned today that in the U.S. it is defined as 13 years old, which I found quite surprising. Here in North America we have so many definitions of “minor” that we still do not know what they meant here in Canada when they wrote the laws. There was no mention of seniors, which I mentioned already this morning.
Overall, why did the government pick such an ambiguous or bureaucratic way of approaching this legislation and offering clarity versus having the rules and doing it right the first time?
132 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, when I first looked at the word “minor” I just assumed what a minor would be. I think my natural assumption was that it meant anybody under the age of 18. That was an assumption I probably should not have made.
I have been listening to the discussion today, and when I asked that question of the member for South Shore—St. Margarets, he gave a really good answer that made me pause and reflect on the fact that even in Canada, we have various terms for minors.
I am looking forward to seeing this go to committee so that it can be studied and then we can hear the pros and cons of defining it. Maybe there is no con to it and only pros, in which case I look forward to hearing what the committee puts forward on that. Maybe there is another reason it should not be defined that I am unaware of at this point. Again, that is something I would like to hear the answers to.
However, the debate today has certainly opened my eyes to that perspective.
188 words
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, personal information is a shared jurisdiction. The Government of Quebec already has Law 25 on personal information.
Are there any guarantees that the new legislation will not infringe on Quebec's jurisdiction? Has the member already considered that? Does he have any examples?
45 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, my understanding, based on the information that I have received, is that the bill aligns itself very closely with the approaches of other jurisdictions, such as where the member is from in Quebec. I think that the two bills can work together and this does not necessarily supersede the other.
Again, that is a good question for the committee to study and report back on. At least, my understanding at this point is that it works very closely with other laws that exist. That may be part of the reason the information was not conclusive in relation to defining a minor. Perhaps that is a decision that has to be made with the provinces and other jurisdictions. I do not know, but I think it is a good question and I too would like to hear the answer to it when this returns from committee.
147 words
All Topics
- Hear!
- Rabble!
- add
- star_border
- share
Madam Speaker, one of the things that concern me in this bill is the proposed personal information and data protection tribunal. The way it is formulated and the vagueness of the membership, especially since many members will be appointed by the government, gives rise to a concern that it might be used as a political tool by the government of the day to overturn rulings it does not like. No other jurisdiction in the world has a tribunal like this. No other privacy regime has a tribunal like this.
I am curious as to whether the member thinks it might be better just to empower the Privacy Commissioner.
108 words
- Hear!
- Rabble!
- add
- star_border
- share
