Madam Speaker, I am proud to continue second reading of Bill the digital charter implementation act, 2020. I am proud because our government set out to deliver an ambitious and comprehensive reform of Canada's framework for protecting the privacy of Canadians while fostering innovation amongst Canadian businesses.
That is exactly what we have done. There are strong imperatives for advancing this important package of reforms to our framework for privacy protection. Canadians deserve and expect strong protections, just as businesses deserve and expect clear rules of the road so that they can confidently deliver the products and services consumers want in an increasingly digital society.
Prior to my time in government, I spent 20 years in the business world. I know how critical trust and confidence can be in business: trust between manufacturers and their suppliers, between exporters and importers, and between businesses and consumers.
In today's digital economy, protecting personal information is key to earning and maintaining that trust.
In that spirit, Bill includes robust privacy protections for Canadians, and rightly so.
Harsh penalties could be imposed for violations. This new law will also provide a solid framework for businesses seeking to prosper in the digital economy. These businesses will be well placed to earn and keep their customers' trust, without compromising their ability to innovate and meet the demands of an increasingly well-informed customer base.
Bill C-11 seeks to strike the right balance between these imperatives and the need to boost Canadians' confidence in the digital economy.
There are important reasons to move forward with this legislation, and I hope all of my colleagues in the House will be supportive.
As we have noted in the previous debate and members are well aware, the consumer privacy protection act proposed in Bill would serve to bring Canada in line with other international jurisdictions. In particular, the CPPA would support interoperability of Canada's privacy regime with that of the European Union, a very important partner for Canada. I will speak more about the importance of that in a moment.
This bill would also support a strong and coherent national framework for privacy so that Canadians and businesses would know what to expect from coast to coast to coast. We are not alone in seeing the urgency of modernizing and strengthening privacy laws in the current environment. The provinces do, too. While Quebec continues to advance proposed new provincial legislation, Ontario and British Columbia are also considering new legislation or substantive amendments to their existing provincial laws.
Moving forward with our legislation now allows us to continue to provide leadership in this area and ensure a harmonized approach to privacy protection across our nation. This is really crucial for business and to encourage investment in Canada. It is also crucial to ensuring that all Canadians can have an equivalent level of privacy protection, wherever they decide to conduct business.
The past year has clearly demonstrated how fundamental digital and data-driven technologies have become in our economy and our society at large. Never before, as a society, have we been more reliant on secure, efficient and accessible technologies as a means of conducting a range of everyday activities.
As I noted previously, the foundation for such a robust digital and data-driven economy is trust.
Canadians have been clear in saying they want strong legal protections for their personal information, backed up by meaningful enforcement and oversight. They have indicated to us these principles are essential to their participation in the digital economy. Businesses also recognize this, and are seeking clear and consistent rules in this area.
Our previous legislation has served us well for almost 20 years, but the digital economy, as we all know, is constantly evolving and we must evolve with it. A modern privacy framework will set the right foundation not only for a post-pandemic recovery, but for many years to come.
I noted how important privacy protection is to the various levels of government, including the provinces and our international partners. The federal private sector privacy law is based on one key objective: bringing in national guidelines for organizations that do most of their business on the Internet, a global network that knows no borders.
We want to build a strong, innovative national economy. In order to get there, privacy rules have to be harmonized at the national level. Businesses and consumers are counting on the leadership of the federal government to set national standards in this area.
In the past few years, a parliamentary committee has examined the private sector privacy law, and I thank the committee for its work. During its study, many business representatives and experts underscored the importance of maintaining adequate protection under the European Union General Data Protection Regulation. We must ensure the free flow of data from the European Union to Canada. The same goes for data from the United Kingdom, whose data protection system is comparable to that of the European Union.
The European Commission clearly indicated that Canada had to make changes to its privacy protection regime to retain its preferred status. As a former minister of international trade and minister of foreign affairs, I can say that this is of crucial importance to Canada.
I am convinced that the proposed reforms to the personal information protection legislation for the private sector will help us attain this objective without giving up our singularly Canadian perspective.
My department's mandate for economic growth and development has required that we consider many factors when determining how to modernize and strengthen a privacy law that applies to the marketplace. One of the goals of Bill is for businesses to understand their obligations so they can build strong privacy protections from the outset in their business. Our current law and the new law that is proposed apply across sectors, businesses and activities. This means the bill must meet a diverse range of needs and be equally easy to follow for any line of work, particularly for small and medium-sized businesses. To achieve this we must first provide businesses with certainty and clarity regarding their obligations. That is why we are proposing to change the way the law is drafted.
PIPEDA, the framework that has been routinely referred to by the acronym, was based on a series of principles. The new law has translated these principles into clear legal requirements. We have also clarified the application of the act in a number of key areas.
Second, we must help businesses better understand how these obligations concretely apply to their activities and operations. The consumer privacy protection act would provide businesses with the opportunity to consult the Office of the Privacy Commissioner of Canada without fear of repercussions. Businesses would be able to fully understand the requirements and to comply before problems arose. The bill includes a framework for the recognition of codes of conduct and certification programs. These provisions will specify how the law applies in particular sectors or areas.
These measures are especially important for our small business owners. They need to be able to focus on what matters most: quality products, good customer service and growing their businesses, while having confidence that they are following the rules. We also need to make sure that we do not add unnecessary administrative burdens, particularly on those who may not have the time or resources to invest in complex legal analysis and advice.
Our approach ensures that fundamental protections are established and enforced in a way that is fair and accessible to all businesses, no matter their size. We must provide sufficient incentives for compliance to ensure a level playing field across the marketplace. In recent years, the Privacy Commissioner has called for a stronger enforcement regime under the private sector privacy law. Bill responds to this.
The Privacy Commissioner of Canada is at the heart of the Canadian privacy regime. The commissioner and his office help businesses understand the act and intervene to protect Canadians in the event of a breach. It stands to reason that the new legislation enhances the role and powers of the commissioner.
The commissioner already plays an education role, which will continue and be strengthened under the new regime. The commissioner will retain his key research and guidance role, as well as being assigned the new task of reviewing organizational privacy practices. The commissioner will also review and approve codes of practice and certification programs. This will give organizations and individuals confidence that personal information is being managed in strict compliance with the law.
Clear guidelines help to protect personal information and prevent breaches. This clarity is essential to the proper functioning of the privacy framework. The bill sets out harsh financial penalties for companies that break the law. The fines and administrative financial penalties are a clear demonstration of the government's commitment to ensuring the protection of Canadians' personal information.
That being said, such sanctions should only be imposed following fair and accessible proceedings. That is precisely why Bill also creates a tribunal to decide on these matters. This means that companies will not have to appear before the Federal Court of Canada. The tribunal will allow all parties to pursue remedies at a lower cost and in a more accessible manner. Over time, the tribunal will also develop a body of privacy jurisprudence.
Let me summarize the approach that the government has taken in modernizing our private sector privacy law. Bill acknowledges the strengths of our existing law, referred to as PIPEDA, in particular its non-prescriptive, flexible and balanced approach to privacy protection. It reinforces individuals' control over their personal information where it matters most, and it enables innovation.
Moreover, it introduces serious financial consequences for the most egregious behaviour. It ensures procedural fairness and recognizes the role of the federal government in regulating the economy, while respecting the important role that provincial governments also play in private sector privacy regulation. This is the continuation of a made-in-Canada approach that recognizes both the right to privacy and the needs of organizations to use personal information for appropriate purposes.
I am confident Canadians will agree that the law offers them the protection they are seeking, together with all the benefits that a growing digital economy can bring. I am happy to take questions from my colleagues.
Madam Speaker, it is a pleasure to join the debate this afternoon on Bill . The bill raises important issues about the privacy of Canadians. It is legislation that seeks to reform aspects of our privacy framework in Canada concerning the use of Canadians' data. I look forward to the debate and the study that is going to take place at committee because I know this bill raises many important issues. It is a very technical area: Canadians will want to delve into the details, find out what the impacts of the provisions are and whether the bill would do the things the government says it would do.
I have some initial comments about the issue of privacy and some of the main threats facing the privacy of Canadians, but I also have a couple of comments on the provisions of the bill. It would provide the Privacy Commissioner with important new order-making powers, it would bring in fines and give individuals the right to demand that their data is destroyed. It would bring in some new powers and provisions for the privacy protection of Canadians, as well as for the Privacy Commissioner. These are some important things to look at, and some study of the details is required.
Certainly, the Conservative caucus is very committed to protecting Canadians' privacy and ensuring that the details all check out with what the government has claimed. I am looking forward to the depth of conversation that I know is going to happen and needs to happen on a piece of legislation in an important policy area such as this.
I want to flag some concerns I have in terms of the process of this legislation, as well as the broader framework of privacy in this country.
This bill was initially tabled in the fall and it has had very limited debate between then and now. It underlines the confusion we have about the government's legislative priorities. It looks very much like the government is trying to set itself up to complain about its legislation not passing by scheduling a bill for an hour here and an hour there, rather than having the kind of focus we would typically expect from a government that is trying to pass legislation. Generally, if a government identifies a bill as an area of priority, it will schedule that bill for enough time to be able to complete debate and then it will proceed to committee. However, today alone we have had an hour of debate on a pandemic election bill, and this afternoon we have gone on to a completely different topic rather than the government picking one issue to move the debate forward.
On a process point, the other thing that is interesting to me about this bill is the committee the government is planning to refer this bill to. The industry, science and technology committee has an important role in looking at the regulation of business, promoting business development in this country and so forth, and the minister who just spoke and is leading this discussion is the , but will this bill be referred to the industry committee? No. Once this passes second reading, the bill will be referred to the ethics committee. The ethics committee has a mandate that includes privacy, but I note in particular that there is a lot going on right now at the ethics committee. It is doing important work trying to get to the bottom of the WE Charity scandal.
If I was cynical about the government's motivations, I would think it was interesting that it had decided to bring forward legislation and then refer it to the ethics committee, given the tradition we have in this place of legislation receiving priority at committee. However, we have critical issues of government ethics and scandal that we need to get to the bottom of. It looks like a manoeuvre to try to push the WE scandal off the agenda. It is very striking to see that the government has been so desperate to avoid discussion of its own ethical lapses, around the WE Charity scandal in particular, that it has done all kinds of things to damage its own legislative agenda simply to cover itself on the ethical front.
In fact, the government prorogued Parliament, going back to last summer. There was important information that was coming out as part of the committee studies that were going on in relation to the WE Charity scandal, and the government prorogued Parliament.
Then this issue comes back in the fall, and we are trying to restart the study of it. The government threatens to declare something a confidence issue in order to avoid having a separate committee that could study it. If we had a separate committee, this would not be an issue, right? If we had a separate committee that was looking at these various issues of government corruption, then we would not have an issue with seeing this legislation studied at the ethics and privacy committee.
However, with this renewed discussion and with new information coming out right now as well, we see the government bringing back Bill . It makes me wonder if the House leader thought, “We want to kill this discussion of the WE Charity situation at the ethics committee, but we can't prorogue Parliament again, right?” I mean, I suppose they could, but it sort of gets more and more obvious what they are doing, so they thought, “Let's bring back this bill that we haven't done anything on in months and try to get it sent to the ethics committee.”
These are just more of the kinds of games, I think, that we see from the government. If it was serious about our being able to get to the bottom of these ethics issues as well as moving forward with this legislation, it would be a simple matter of either allowing the creation of that special committee to look at the WE Charity issue or having this bill go to the industry committee. Again, it just raises the question: What is the government trying to hide here?
The government's ethics failings are well known, and it seems the next step in its plan to avoid discussion of its terrible ethical record will be to call an election, a particularly extreme step to kill all of its legislation and shut down important discussions in Parliament on a wide variety of issues, including government ethics.
If we have an early election, of course we are not going to get anywhere on this bill, so hopefully the government will resist the urge to put politics and its own political interests first and instead focus on the kind of policy work that we are doing and are prepared to do in this place to move important issues forward.
In this speech, I want to also zero in on an important issue of privacy, that being the threat to Canadians from foreign actors who are trying to access our data and who are, in many cases, trying to interfere in Canadian institutions, trying to intimidate Canadians and potentially trying to steal intellectual property. In the interest of Canadians, we need to take the threat to privacy that comes from foreign actors very seriously. It is my view that the defining national security threat of our time is interference and intimidation in Canada by foreign state-backed entities.
I have had the opportunity to work with many Canadians who have themselves been direct victims of this kind of intervention, threatening their security and privacy. We had a press conference here on Parliament Hill when I launched Motion No. 55, which is a private member's motion that I am putting forward with respect to foreign state-backed interference and intimidation. We had four people participating in that press conference who were from different backgrounds, from different parts of the world originally, who are now Canadian. They shared their own stories of foreign state-backed intimidation, and all of them expressed frustration at the nature of the response. They felt they were being referred back and forth among different institutions and that we did not really have the capacity to support them effectively and identify who is really responsible for addressing these issues. Is it CSIS? Is it Global Affairs? Is it the RCMP? Is it the local police? Who do they go to? Who responds to it, and then what is the response from the government?
The response from the government has been quite weak. In the case of this minister who is now responsible for this legislation, we had many of these discussions in his previous role as the foreign affairs minister. I would ask him about what he was doing in response to the likely and in some cases very evident involvement of foreign diplomats in the interference with and intimidation of Canadians, and he would kind of look at the camera and tell the diplomats not to interfere in Canadian affairs.
It is great to say that, but we need to have a policy framework and a strategy in place to protect the privacy of Canadians when it is threatened by malicious foreign actors, which are often state-backed or directed actors.
It is with this in mind that Conservatives put forward an opposition day motion, which passed, calling on the government to put in place a comprehensive plan to protect Canadians from this kind of interference and intimidation. The government just failed to respond effectively to that.
My private member's motion, Motion No. 55, reiterates the call of that opposition day motion, but it also particularly focuses on the issue of support to Canadians who are victims. My motion is saying that we need to do more to support Canadians who are victims of foreign state-backed interference and that the federal government's approach to privacy in this area needs to involve cross-jurisdictional co-operation.
It also says the federal government should seek to work collaboratively with provincial, territorial and municipal governments on responding to foreign interference, recognizing we do see manifestations of this foreign interference happening at other levels of governments, such as efforts to capture elites, control institutions, misdirect funds to their interest, and so forth. We see those attempts at intimidation happening at other levels of government, and the response needs to involve effective engagement of those other levels of government as well.
This is another area where the government could be doing more, and needs to do more, to respond to this primary issue of our vulnerability in terms of national security.
In the midst of us saying the government needs a plan and a strategy on this, the simple thing it could do would be to take on this principle of first doing no harm. If it really recognized the threats regarding security in this area, the first thing it would do would be to just say no to Huawei, because we know there are threats to Canadians' security and privacy associated with Huawei being involved in our 5G network.
There is really no disputing the close relationship between Huawei and the Chinese state. We know all private organizations based in China have a high degree of vulnerability to influence and control by the Chinese Communist Party, such as the requirement to defer to party committees, the requirement that information be shared with the Chinese military, and the requirement to respond to requests by the Chinese military.
We know the vulnerabilities that exist across the board, but it is especially the case when we look at a company like Huawei. Clearly, there is a long-standing and very close relationship between the state and this company. Nobody else in the world has trouble figuring this out. Four out of five Five Eyes countries have understood the importance of saying no here.
Our own interests are at stake here, as well as the opportunities for ongoing effective co-operation with our partners, who see these risks. We do not want to be perceived in Canada as being a point of vulnerability. If we want to be able to maintain the levels of co-operation that are so important for our interests, we have to work effectively with our allies and give them reason to have confidence in us.
Yes, the government needs to have a comprehensive plan to address foreign interference and protect Canadians' privacy, but why not just start by doing no harm and saying no to Huawei. As well, the government has just been absent in answering these very basic questions when it comes to the involvement of Huawei in our 5G network.
Going back, we had a previous public safety minister, Ralph Goodale, who said that they would make a decision before the election. We are not talking about the election the government is planning now, we are talking about the last election in 2019. The government said there would be a decision on Huawei before that election. We probably will not see a decision on Huawei at this rate before the next election, or maybe even the one after it, if Liberals stay in government. If Conservatives form government, there would be a decision very quickly when it comes to Huawei, but the government has put it off.
The Liberals have continually said that the decision is coming. Part of our opposition day motion dealt with Canadian intimidation and privacy issues around foreign-state-backed actors. Our opposition day motion included the requirement that the government make a decision with respect to Huawei, but the deadline came and went. The Liberal government, by the way, has a track record of ignoring the motions that are passed by a majority of Parliament.
I think the Liberals' effort to create this narrative about Parliament is not working. The reality is that Parliament is generally working, but sometimes it does things they do not like. Sometimes the opposition works together to pass motions the government does not want to see pass. Sometimes the opposition puts an issue on the agenda and pushes it so much that many government members support it, as we saw with the Uighur genocide, even though the government abstains.
To me, that is a sign of a Parliament that is lively, that is working and that is doing its job because it is holding powerful people to account. That is a big part of what Parliament is supposed to do. The government wants to spin this narrative of Parliament precisely because it is working: it just does things sometimes that the government does not like. Some of that is borne out of the leadership of our party. Some of it is borne out of the very good co-operation that has been on display among the opposition parties.
The point is, we had a motion pass that called on the government to make a decision on Huawei and it still has not. This is a huge issue for Canadian security, for Canadian privacy and for the protection of our national interests at this critical time in global affairs. We are seeing heightened competition, and Canada needs to be clear and principled in terms of standing up for, and standing with, other countries that believe in freedom, democracy, human rights and the rule of law. Part of protecting the rule of law, of human rights, is emphasizing the importance of protecting the privacy of Canadians and excluding actors from our systems who we know will not respect that privacy: actors who say they have a legal obligation to provide data to a foreign military when asked.
Regarding Huawei, there is this issue of looking at the kinds of human rights violations that they and other Chinese-state-affiliated companies are involved in. We see, with the Uighur genocide, the technological enabling of human rights violations by companies such as Dahua and Hikvision: companies that the Canadian pension fund at one time invested in.
We are talking about the involvement of Huawei and other companies that are complicit in detailed monitoring, tracking and controlling. We see these horrific violations of privacy taking place inside China right now: horrific violations of privacy that are being enabled by the very companies that the government has not yet refused access to Canada. That should be a huge concern in any privacy debate we are having.
When the same companies are part of things like the social credit system, whereby individuals are tracked in terms of whether the government thinks they are behaving well, and their ability to travel and participate in events is determined automatically by algorithms based on intense monitoring and evaluation, a very Orwellian system is being brought in.
Then we have some of the actors who are involved in developing these kinds of technologies and deploying them. Those same actors are looking to do business here in Canada. That should concern us. The government needs to make some clear choices. It needs to decide where it stands on these issues and needs to start standing with us, in the opposition, who are taking a principled stand in defence of human rights, in defence of privacy and in defence of our national security. We are recognizing and responding to the very real threats that we see from various actors.
One of the other issues that I hope to see taken up at committee is people's privacy in terms of their intimate images, and some of the horrific abuses of people's human rights that we have seen perpetrated through the Pornhub platform. We have heard testimony at committee that people's intimate images, even involving minors, were posted repeatedly without their consent. That is another privacy issue that Parliament must act on urgently, without delay.
Madam Speaker, I am pleased to participate in the second reading of Bill , the digital charter implementation act, 2020. I will be splitting my time today with the member for .
When Canada's privacy law was introduced in 2000, Parliament intended that it would achieve two objectives, which were privacy protection for individuals and the growth of electronic commerce. Over 20 years later, our government is introducing this legislation to provide an updated strategy for protecting privacy in our new digital world.
I have heard loud and clear from the constituents in my riding of Mississauga—Erin Mills, and they want to see strong privacy laws. These privacy laws not only protect consumers and help build trust in the digital marketplace, but with the consumer privacy protection act, a principled and agile privacy enforcement regime would create a vital safeguard as companies engage in the digital economy.
Today, I would like to provide further insight into a key aspect of the bill that will not only provide guidance for businesses for protecting individuals' personal information, but will also support responsible innovation. I am speaking today about provisions in the new consumer privacy protection act to formally recognize codes of practice and certification systems as a means of demonstrating compliance with the law.
A key strength of our current private sector privacy law, commonly known as PIPEDA, will be maintained in the new consumer privacy and protection act. That strength is a principled approach to rule setting. Our private sector privacy law applies to all organizations in all industry sectors of all sizes and levels of sophistication. This level of general application is crucial in order to establish a baseline of privacy protection that applies across the marketplace.
While comprehensive, this law must also be flexible, non-prescripted and technology-neutral so that it can be applied in all circumstances. These characteristics have long been recognized as a key strength of the existing law and there is widespread support for maintaining this approach. However, it is sometimes a challenge for organizations, especially smaller businesses without dedicated legal resources, to understand how to implement these high level obligations within their specific context.
For example, consider a situation where an organization is using a cutting edge technology which has not yet been the subject of a finding by the Privacy Commissioner or where an organization must handle complicated data flows with complex accountability, such as in connected and automated vehicles. These challenges are becoming more commonplace in a data-driven economy.
To help address these problems and to provide assurance to businesses and consumers alike, the consumer privacy protection act would allow any entity to apply to the office of the Privacy Commissioner for approval of a code of practice that provides a specific set of rules for how organizations can operate in compliance with the law. This approval would be particularly useful for organizations using a new technology or operating with a new business model.
This type of regulatory certainty is very much needed in today's rapidly developing economy. It gives organizations and their business partners a level of comfort that they are operating on the side of the law. It also supports a level playing field in areas where there is no jurisprudence or specific guidance for organizations. It also makes it more transparent to Canadians how their personal information is being used in these circumstances. To take it—