INDU Committee Meeting

    I call this meeting to order.

    Good Wednesday afternoon to you all, colleagues.

     Welcome to meeting number 124 of the House of Commons Standing Committee on Industry and Technology.

    Today’s meeting is taking place in a hybrid format. Pursuant to the Standing Orders and the order of reference of Monday, April 24, 2023, the committee is resuming consideration of Bill C-27, Digital Charter Implementation Act, 2022. Today we will continue clause-by-clause consideration of the bill.

    Before we begin, I would like to remind all members and other meeting participants in the room of the following important preventive measures.

    To prevent disruptive and potentially harmful audio feedback incidents that can cause injuries, all in-person participants are reminded to keep their earpieces away from all microphones at all times. As indicated in the communiqué from the Speaker to all members on April 29, the following measures have been taken to help prevent audio feedback incidents. All earpieces have been replaced by a model which greatly reduces the probability of audio feedback. By default, all unused earpieces will be unplugged at the start of a meeting. When you are not using your earpiece, please place it face down on the middle of the sticker for this purpose that you will find on the table, as indicated. Please consult the cards on the table for guidelines to prevent audio feedback incidents. As you can see, the room layout has been adjusted to prevent this type of incident. These measures are in place so that we can conduct our business without interruption and to protect the health and safety of all participants, including the interpreters. Thank you all for your co-operation.

    Without further ado, I would like to welcome the witnesses, who come from the Department of Industry. We have Samir Chhabra, director general, strategy and innovation policy sector; and Runa Angus, senior director, strategy and innovation policy sector. Welcome to you both, and thank you for agreeing to join us.

    (Clause 2)

    As I remember, we were discussing Mr. Garon's subamendment to amendment CPC-7 at the last meeting, and Mr. Van Bynen had the floor.

     I believe Mr. Van Bynen was done with his remarks. Were you done, Mr. Van Bynen?

    The list is open.

    I recognize Mr. Perkins.

     Thank you, Mr. Chair.

    Thank you, witnesses, for being here again. I'm sure it will be very good, even though our regular, Mr. Schaan, is not here. We'll muddle through, I'm sure.

    Just for the record, over the last week we've had a lot of conversations about the CPC-7 amendment and the subamendment from Mr. Garon, and what we could do going forward to find a way to make this work for all sides. I think we have a compromise. It involves, from our perspective, supporting Mr. Garon's subamendment to CPC-7. If we get through that positively, I would then propose a new subamendment that I think will add some language, soften it up and make sure it works for everyone.

     Thank you.

    Mr. Turnbull.

     Thank you.

    Yes, I agree that there have been some really good conversations, so I'm hoping we're at a point whereby.... I feel that what Mr. Perkins has drafted and circulated is where we want to end up. I know we are in consideration of Mr. Garon's subamendment.

     I think what we agreed on in conversations before the committee meeting was.... Procedurally, I'm not sure what the best way is to move forward, but perhaps we can vote in support of Mr. Garon's subamendment, and then I understand Mr. Perkins will introduce a subamendment to that.

    I would just say, obviously, there's a bit of a leap of faith in how things will proceed, but as long as committee members are clear that that's the way we will proceed, we will land on the wording that Mr. Perkins has circulated, which includes the word “may”. I think that's really significant. Based on the testimony we had from our officials, that word makes a big difference in how the law will be interpreted. I think it's important that that's where we land.

    As long as that's where we're all in agreement to land, I have no issue with moving forward and voting in support of Mr. Garon's subamendment and then voting in support of the changes Mr. Perkins has put forward.

    Thanks.

     Thank you very much, Mr. Turnbull.

    I appreciate the co-operative work that was accomplished by members during this last constituency week.

    I see no other speakers. Is there consensus to adopt the subamendment by Monsieur Garon, with the understanding that the amendment will be subamended?

     (Subamendment agreed to)

    The Chair: Thank you very much, colleagues.

    We're now back to CPC-7 as amended.

    I'll recognize Mr. Perkins.

     Thank you, Mr. Chair, and thank you, colleagues.

    As a follow-up to what Mr. Turnbull and I just said—and thank you, Mr. Garon, for your amendment—I would like to propose another subamendment to CPC-7, which was originally proposed by Mr. Vis.

    It has been circulated. In a minute, I'll read it with the additional words we've just passed.

    Just to remind those who may be watching, we're dealing with the definitions section of the bill, and we're adding the definition for the word “sensitive”.

     It says:

     Then we add the word “may” and change the word “includes” to “include”, so it's “which may include, but is not limited to” all the following that's already in the motion: (a), (b), (c), (d), (e), and then (f) changes the word “security”, since that's not a Canadian term, to “social insurance”, so it substitutes “insurance” for “security”. Then (g) deletes the word “or” and after (h) there is a new (i), as we discussed, I think, in our last meeting:

    I will leave that as moved.

    I will say that during the break we had a consultation with the current and past privacy commissioners, and they're both comfortable with this.

    That's great.

    Mr. Perkins, I think the French version of the subamendment is a bit of a problem.

    I think there is a bit of an issue with the French version.

    I'm still learning.

    The Chair: Well, I'm sorry to say that it shows—no pun intended.

    Some hon. members: Oh, oh!

    The subamendment reads: “en matière de protection de la vie privée, lesquels peuvent comprendre, qui comprend notamment et sans limite”. The words “qui comprend” should be deleted. The text would then read as follows: “lesquels peuvent comprendre, notamment et sans limite”. I think that more accurately reflects the English version.

    Mr. Vis, the French version reads as follows: “une attente élevée en matière de protection de la vie privée, lesquels peuvent comprendre, qui comprend notamment et sans limite”. So there's a repetition that makes no sense. The version that Mr. Perkins poses reads: “qui comprend notamment et sans limite”. The sentence should therefore read: “lesquels peuvent comprendre, notamment et sans limite : a) Son origine…”.

    Far be it from me, in my—

    I see Mr. Garon and Mr. Généreux seem to agree on that.

    At the end—

    The word “ou” should be added following point h).

    Yes, that's true.

    An “ou” is missing after point h). I'll discuss that with the legislative advisers.

    As for point i), “des données de géolocalisation révélant l'endroit où il se trouve”, it's a bit odd as well.

    Mr. Garon, I'm looking at you because the English text reads as follows:

“geolocation data revealing an individual's location”.

    The translation is as follows: “les données de géolocalisation révélant l'endroit où il se trouve”. Should it instead read, “où un individu se trouve” or “où l'individu se trouve”?

    An hon. member: No, it's fine the way it is.

    It seems that “où il se trouve” is correct, but I think both previous changes are appropriate, particularly the addition of “ou”.

    In any case, I leave it up to you.

    Has everyone heard the subamendment proposed by Mr. Perkins?

    Mr. Vis, are you...?

    Oh, no. I'm just missing my headset. I was looking for a headset.

    Okay.

    Are there any comments on the subamendment proposed by Mr. Perkins?

    Everyone has heard the subamendment, so is there consensus to adopt it?

    Mr. Masse.

     I was just wondering whether we could get a brief description from the officials on this for the record. We were lobbied heavily on this, and perhaps a slightly better explanation for changing it might be worthwhile, even for the record, if that's possible.

     Sure thing.

    Can you update the public in terms of what this means as far as the amendment that's been changed and presented, especially in describing the “may”, which I think is probably the most germane with that?

    I understand that the modifications being proposed through this subamendment would add to the definition of sensitive information, as follows:

    Then it provides the list of items, (a) to (i).

    Our interpretation of this is that it provides directional guidance to the Office of the Privacy Commissioner about information that would generally be considered sensitive but leaves open the possibility for the Privacy Commissioner to identify, on a contextual basis, information that could be sensitive in a different context that the committee may not have identified on this list.

    It also leaves open the possibility that some of these categories of information in accordance with, for example, the Supreme Court decision that we briefed this committee on some weeks ago, RBC v. Trang, would leave opportunities for the OPC or the courts to undertake a contextual analysis that would determine that in some instances—likely rare instances—things like financial data may not be sensitive.

    That would be the ultimate effect as we read it.

    That then deals with the concern that's being expressed that.... I forget the term they use, but fatigue or something like that was used in terms of.... Consent fatigue, yes.

    I want to thank the mover of the...first of all, the Bloc, and then the Conservatives for...and I guess the government too—everybody who is getting to this. It provides the Privacy Commissioner with some empowerment when necessary, but, at the same time, we get to that issue. A lot of people raised those concerns.

    Thank you very much, Mr. Masse.

    Mr. Vis.

    Just following up on that exchange, did the department meet with the Canadian Bankers Association in advance of the two letters we received?

    I believe we may have received an email from the Canadian Bankers Association. There may have been dialogues at various points as well. I don't know the timing of the meetings compared to the letters you're referring to.

    I was referring to the May 7 letter sent to the industry committee.

     No, there was no meeting around that date.

    Thank you.

    Okay. Thank you very much, colleagues.

    For this subamendment proposed by Mr. Perkins, is there consensus to adopt it?

    (Subamendment agreed to)

    The Chair: We're back to CPC-7, as amended.

    (Amendment as amended agreed to: yeas 11; nays 0 [See Minutes of Proceedings])

    The Chair: Thank you, colleagues. Congratulations.

    I had NDP-6 on my list, but I'm guessing Mr. Masse won't be moving it.

     That's right, Mr. Chair. It's no longer necessary.

    Thank you.

    Okay. That takes us all the way to CPC-8.

    Mr. Perkins.

     Thank you, Mr. Chair.

    The consumer privacy protection act makes reference to the term “significant impact” on several occasions, and we are concerned that the CPPA does not currently explicitly include a definition of what this term means. Given the significance of this term throughout the bill, it poses considerable issues in the face of conflicting interpretations and views of what this term constitutes to stakeholders and businesses.

    The term “significant impact” is currently featured twice in the bill. In proposed paragraph 62(2)(c), it states, under “Policies and practices” of “Openness and Transparency”, that an organization must make:

     It also says that this section concerns how an organization “must make...available [any] policies or practices put in place to fulfill” it.

    Then, in proposed subsection 63(3) on access to personal information, concerning the use of automated decision systems, it makes another reference: “If the organization has used an automated decision system [with regard] to an individual that could have a significant impact on them, [it] must, on request...provide...an explanation” to the individual. This section concerns an organization's requirement, on request, to fully inform an individual of any use of personal information and to provide access to that information.

    In the same way that “automated decision system” is defined in the CPPA to explicitly explain and outline the use of certain technologies, the impact of these technologies should be explicitly defined in this bill to remove any ambiguity and protect Canadians. The consequences of not including the definition of “significant impact” present a threat to the compliance of personal information and protection. We've worded it in a way that says “prescribed criteria”, which I believe allows flexibility for policies and perhaps even regulations to be drawn up after the bill is passed in this area, but I would ask the officials to comment.

     We would agree that, as defined here, “significant impact means an impact that meets the prescribed criteria.” The government would need to undertake a regulatory process following this to set those criteria.

    All right.

    Are there any comments on amendment CPC-8?

    (Amendment agreed to: yeas 11; nays 0)

    Thank you, everyone.

    That brings us to amendment CPC-9.

    Before turning the floor over to Mr. Williams, I must inform you that, if amendment CPC-9 is agreed to, amendments NDP-32, NDP-38 and CPC-70 may not be moved as a result of a line conflict; amendment NDP-37 can't be moved either as a result of a line conflict and for reasons of consistency.

    Go ahead, Mr. Williams.

     Thank you, Mr. Chair.

    As you noted, this is a rather wide-ranging amendment, making changes in numerous proposed sections and subsections through the CPPA. Its purpose is to transfer power to issue monetary penalties for violations of the CPPA from the privacy tribunal to the Privacy Commissioner, where we in the Conservative Party believe the power should be rested and where it should have been rested in the first place.

    We are of the opinion that the tribunal is completely unnecessary and counterproductive. It will make Canada an international outlier compared to how our peer nations operate. It is unneeded bureaucracy, which will only serve to slow down and dilute the resolution of privacy violations. It will hamper the ability of the federal and provincial privacy commissioners to work together to perform joint investigations and, most concernedly, by existing within ISED, the tribunal, whose members will be patronage appointees by the minister, is an attempt to impede and interfere with the independence and jurisdiction of an independent officer of Parliament.

    The proposed tribunal will make Canada an international outlier. No other peer nation—not the EU, the U.S., the U.K., Australia or any other G7 nation—has a privacy tribunal. Each of these other nations has the same system. The privacy regulator investigates and issues monetary penalties to violators. If the violator is unhappy with the result, they take the regulator to court. We know this, because that is the way our privacy enforcement system currently operates. The Privacy Commissioner, PIPEDA and the Privacy Act do not have a tribunal, and the enforcement process is working quite well.

    According to the Office of the Privacy Commissioner, for more than 40 years this is how the process has worked, and only once in the 40-year period have the courts taken issue with an OPC ruling. There is no need to reinvent the wheel by introducing a quasi-judicial body into the violation of the enforcement process. By trying to reinvent the wheel with this tribunal, the result will be delayed justice for Canadians whose fundamental right to privacy has been violated. Justice delayed is justice denied.

    When I think about the quasi-judicial tribunals of ISED, of course my thoughts immediately go to the equally unnecessary Competition Tribunal. It's a body that in its nearly 40-year existence has never even once blocked a merger that was proven to be anti-competitive by the Competition Bureau. It's a body where the average time for delivering a decision is well over one year, except, surprisingly, in the Rogers-Shaw decision. Even then, those decisions can be appealed in the courts.

    The tribunal will also serve to drag out the efficient resolution of cases. I will let the words of the Privacy Commissioner stand for themselves. He stated:

    The inclusion of the tribunal in this act, as argued by both federal and provincial privacy commissioners, will also weaken the joint investigation processes that are undertaken between federal and provincial governments. This process will also diminish interoperability between provinces and could result in the federal government making the privacy tribunal a necessary requirement for compliance within the federal act.

    We've seen several recent examples of the federal and provincial privacy commissioners working together to protect Canadians' fundamental privacy rights.

    In 2021, the federal commissioner and B.C., Alberta and Quebec all worked together to investigate and stop Clearview AI from violating Canadians' privacy rights through illegal scraping of images from social media sites to build a facial recognition database. In 2022, the federal, Alberta, B.C. and Quebec commissioners again worked together to investigate and stop Tim Hortons from illegally tracking Canadians' location data after they made a purchase. In 2020, the federal, Alberta and B.C. commissioners stopped shopping mall owner Cadillac Fairview from collecting and using photos of consumers when they stopped to use the store directory screens.

    We have heard and talked a great deal so far during this clause-by-clause process about making sure that privacy protection laws are consistent across the country to allow ease of enforcement as well as ease of business operations. As we heard from both federal and provincial privacy commissioners, the tribunal will threaten the ease of enforcement by regulators across each of the provinces and territories and across the country.

     The Privacy Commissioner and his office are one of nine fully independent officers of Parliament. In the words of the Library of Parliament:

    I want to emphasize that last line again: “These officers are responsible directly to Parliament rather than to the government or a federal minister.”

    The industry minister should not have a say over the conduct of the decisions of the Privacy Commissioner. The OPC is supposed to be fully independent. If the minister or government does not like a decision of the Privacy Commissioner, then they can appeal the decision in the courts, as they have done since the OPC was created in 1977. The proposed tribunal will completely undermine that independence. It places an ISED-run, ISED-controlled, ISED-funded and industry minister-appointed privacy tribunal in between every single OPC ruling and decision. The Office of the Privacy Commissioner is an independent body, and this amendment will help to preserve that independence.

    This question is for Mr. Chhabra, although any of the officials may answer. We know from submissions and testimony that the current and former privacy commissioners oppose the tribunal; the provincial privacy commissioners oppose the tribunal, and almost all privacy advocates and experts oppose the tribunal. Your department has been the one asking and...taking ministers with stakeholders, the minister's famous 300-plus meetings. Which stakeholders have actively been supportive of the tribunal?

    As was pointed out, CPC-9 is a very broad set of proposed amendments that would, as we understand it, have the effect of making three important changes. First, it would limit the imposition of cost awards against the OPC. Second, it appears to remove the private right of action that would allow folks who have been impacted by a transgression of law to be compensated for their loss. Third, it would remove the tribunal from part 1 of the act.

    We see the tribunal as a critical element that's necessary to ensure that the system is credible and fair. Removing it would be inconsistent with the current commissioner's recommendations. We have since 2018 conducted a significant number of consultations and engagements broadly engaging Canadians. I believe in 2018 there were more than 30 round tables across the country. More than 550 Canadians participated in those engagements. The more recent figure of 300 meetings that the honourable member referenced, I believe, refers to part 3 of the bill, on AIDA, which obviously we will come back to later.

    A number of stakeholders pointed out that it would be perhaps unprecedented and certainly out of alignment with international examples, and even some domestic models and examples, to have one individual carry out an ombuds function, an investigatory function and an adjudicative function all in one. There have been, to our count, 50 cases since 2003 that have gone from the Privacy Commissioner on to court. By our count, 70% of those court decisions disagreed with the OPC's position on the issue. Expecting the Privacy Commissioner to carry out these very distinct functions in addition to the significant new powers that have been added....

    The CPPA will provide the Privacy Commissioner with a number of new enforcement powers. They include the ability to issue binding orders following investigations, which can order compliance with the CPPA. They can order organizations to cease activities that violate the CPPA. They can force compliance in a compliance agreement and also make public any measure taken to comply with the CPPA.

    In addition, the CPPA enables the commissioner to recommend administrative monetary penalties. That's the point at which a recommendation would be made to the tribunal around the penalties. The orders and all those are powers being vested directly with the commissioner and not with the tribunal. It's important to recognize as well that the tribunal has an important appeal function to play and has expertise in the space by virtue of the fact that three of the six members of the tribunal must be recognized as privacy experts.

    I also think it's important to point out that we don't see any risk of hampering joint investigations that would be undertaken between the federal Privacy Commissioner and any provincial counterparts. A number of international counterparts do have tribunal-type approaches, including Australia, New Zealand and Ireland, just off the top of my head. The U.K. also has a tribunal approach, organized slightly differently. The CAI in Quebec also has a tribunal approach to doing this function. We don't see any issues around joint investigations at all. In fact, the CPPA specifically encourages and allows for the OPC to engage with other regulators to share information and to leverage that information to the best effect to protect Canadians. It's also consistent with other areas of federal regulation in which tribunals are used—agriculture, transport, competition and international trade.

    The efficiency of the CPPA tribunal has also been raised in this recent dialogue. It's important to recognize that we see efficiency gains actually being made by providing a tribunal that, first of all, pays deference to the commissioner's decisions, whereas a court would take a de novo proceeding. By having proceedings that are more informal and easier to understand and engage with for ordinary Canadians, rather than needing to have a lawyer go through the proceedings with the Federal Court, it would be less costly and easier to access as well, for those reasons, and for ordinary Canadians to engage with.

    There are a number of very important reasons that we feel the tribunal is the right approach. The department did receive many, many inputs to that effect from a range of stakeholders, dating back to 2018, before the previous Bill C-11 was introduced.

     I hope that helps to answer the question.

    Thanks.

    I just want a few more specifics. Can you give me a couple of examples of who suggested the tribunal for stakeholders? Did you meet with them?

     The department published a white paper in 2019 on the proposals, in which we specifically asked questions on the tribunal, whether the Privacy Commissioner should be given AMP powers and whether those AMP powers need an oversight mechanism. To that, we received a number of responses from industry, from privacy stakeholders and from the Privacy Commissioner himself. I'm just going to pull up a list.

    I'm just going to get Mr. Chhabra to correct himself.

    You mentioned that the current Privacy Commissioner recommended it. We can't find that recommendation. We have that the current Privacy Commissioner does not recommend the tribunal right now. Is that correct?

     The current Privacy Commissioner has two recommendations with respect to the tribunal.

     They've asked that the tribunal's decisions be reviewed by the Federal Court of Appeal, as opposed to the Federal Court, and they've asked for more flexibility with respect to compliance agreements. Those are the two recommendations from the current Privacy Commissioner.

     From what we understood, those were if a tribunal were to be in place, but their preference would be to not have a tribunal and give more power to the privacy commissioners themselves and their office.

    Just to counter one other claim as well, they've asked for and have said that they need more resources to carry out the duties they'd have. To handle the burden you mentioned, there would be a whole division that handles the fines and the penalties, and then the commissioner would be freed up to be able to handle more of a caseload. I think that was what was stated in testimony.

    I'm just going to mention witnesses who were against the tribunal, because we have a list of those, if you're still looking for the list of those who were for it.

    We had the Centre for Digital Rights. The Privacy Commissioner of Alberta was against the tribunal. The Option consommateurs was against it. The former U.K. privacy commissioner was against it. You could say that the Public Interest Advocacy Centre was against it. The Canadian Civil Liberties Association was against the tribunal. The Privacy and Access Council of Canada was against it, as was the University of Ottawa. A lawyer at McInnes Cooper, David Fraser, was against it. Daniel Therrien, the former Privacy Commissioner, was against a tribunal. Philippe Dufresne, the Privacy Commissioner of Canada now, is against the tribunal as a whole.

    While you're looking for your list of the ones who supported it, these are all witnesses we had who were against the tribunal. Have you found your list?

    I do have the list of the testimony of witnesses who supported the tribunal.

     There was Elizabeth Denham, the former U.K. information commissioner, and also the former B.C. commissioner, who spoke about the U.K. tribunal system and how it aids the process and ensures administrative fairness. We also had Adam Kardash, who supported the tribunal. He's a lawyer with CANON, which is the Canadian Anonymization Network. Michael Geist also suggested that the tribunal is granted some deference when it goes to court, and that has the potential to strengthen the outcomes of the process. Mr. Scott Lamb, a partner at Clark Wilson LLP, also supported a tribunal, as did Mr. Antoine Guilmain and Ms. Michelle Gordon.

    Those are the witnesses during the committee hearings who supported the tribunal.

     Okay. I'm now going to give you testimony from the current Privacy Commissioner. I know it was mentioned at the beginning.

    Mr. Vis was going back and forth with Mr. Dufresne, and Mr. Vis asked, “Is it your belief that a tribunal will delay your ability or the ability of people to have sensitive information wiped from the Internet?”

     Mr. Dufresne answered, “My view is that adding a level of review to the process will add a delay and a cost, and so I've given two options to solve that.”

     The other part he mentioned was this:

    Basically, he and former commissioners who we saw have added the burden of this. I want to go down to another line of questioning with you, and it goes to—

    I have Elizabeth Denham's too.

    Mr. Ryan Williams: I'm sorry. I'm going to add—

    Mr. Brad Vis: Hers is contradictory to what she said.

     Okay.

    You mentioned the U.K. privacy commissioner, but this is Elizabeth Denham's testimony. From the top, she said:

    You mentioned that Elizabeth Denham was supportive of the tribunal. From this testimony, it seems that she was against the tribunal.

     There are a number of pieces there that I'd like to try to unpack. I think in the context of order-making powers, we've already been clear that the order-making powers in the CPPA would vest with the commissioner, so it's difficult to see how the tribunal would be slowing down the order-making abilities of the commissioner.

    The notes that we have here from Ms. Denham include that there is a tribunal system in the U.K. and that administrative tribunals are used across many areas of law. It may seem like a lengthy process, but over time the tribunals become expert tribunals, and the Bill C-27 proposals are aimed at ensuring administrative fairness. That is really what we're talking about here—the carriage of justice, administrative fairness and ensuring that there is an appropriate delineation of powers and responsibilities.

    My colleague will take a moment as well.

    I just want to jump in on the current commissioner's assertion that the tribunal would add a fourth layer in the process. I think it's important to understand the process now and how the tribunal would change it.

    The process now is that the Privacy Commissioner is an ombudsperson. They actually have investigative powers but no decision-making powers, so what happens is that the commissioner issues some findings. A company can choose whether or not to undertake the recommendations based on the findings. If they do not, the commissioner's only option is to take that company to court. When they take that company to court, the court gives the commissioner no deference. It's like any plainant taking a company to court. They have to make their case. As my colleague suggested, many times the commissioner loses those cases, as most recently happened in 2023 with the case against Facebook. Obviously you can appeal that decision to the Federal Court of Appeal and eventually to the Supreme Court. That's the current process.

    This new process, first of all, gives the commissioner decision-making powers. The commissioner can issue compliance orders—which is something that it can't do now—which actually compel an organization to do or not do something, and can recommend AMPs. Those decisions can be appealed to the tribunal, but once the tribunal makes a decision.... Actually, even before that, the tribunal has to actually defer to the OPC on many questions of fact and questions of law.

    That's the first difference with a court, which wouldn't do that. The second difference is that once the tribunal makes that decision, the decision is final. The decision cannot be appealed. The only recourse possible is a judicial review.

    A judicial review is not the same thing as an appeal. An appeal is a substantive reconsideration of the merits of a case. With a judicial review, a court—and in this case it would be the Federal Court—simply decides whether or not the tribunal acted reasonably. It's not a substantive reconsideration of the case, hence it's not an appeal, so the tribunal's decision is final. That means it's a shorter process; it's a quicker process and it's a less expensive process.

     To add to that, on the point about compliance orders, the current Privacy Commissioner did point out a concern about his ability to enter into compliance agreements that would include financial considerations. An amendment that would give the Privacy Commissioner the ability to enter into a compliance agreement at any stage of the process and to include financial considerations in that has been proposed.

    We feel that the commissioner's perspectives on this have been well understood and taken on board.

    We had one witness, Jim Balsillie from the Centre for Digital Rights, talk about it from a business perspective. He talked about the other layer. He said what's going to happen is that if you're a corporation trying to negotiate with the commissioner, you'll just shrug your shoulders and say, “Well, I'll see you at the tribunal, which is quasi-judicial.”

    We've seen some of this with the Competition Bureau. With the Rogers-Shaw case, it was so bad that when the tribunal made a ruling opposed by the competition commissioner, the company itself was able to then sue the commissioner. It created another layer. It created a precedent that we don't want to see happen with our privacy laws.

    I'd like to go to this other question as well. There's no other privacy law regime in the world that has this tribunal. We're looking at progressive regimes in the EU, as well as regimes in California, Utah, Colorado, Virginia and Connecticut and the proposed American data privacy and protection act, and no one has proposed or established a tribunal like the tribunal being proposed, so why is Canada trying to be an outlier? What would be the benefit?

    I think it's a really important question.

    I appreciate where the committee members are coming from in terms of identifying good practices and opportunities to bring into Canadian practice things that have worked well in other jurisdictions. I also think it's really important to make distinctions about the ways in which the various systems work. We cannot holus-bolus import various pieces without understanding the context and the way they're developed.

    I believe the honourable member just mentioned California. California does not have a consent-based system. California has an entirely different establishment whereby people can essentially opt out of having their data collected but in a way that is completely different from actually having to seek consent and have that as the cornerstone of your approach.

    The reason I raise this is that understanding the way these legal frameworks work in their totality is really critical to understanding which pieces could simply be added to or extracted from a given mix and would make sense and be coherent within that legal framework and then within the Constitution or other broader legal frameworks in a given jurisdiction. In this instance, we have seen tribunals be effectively deployed in privacy in the U.K. and in Quebec. Particularly, very closely aligned with the approach we're suggesting here would be Australia, New Zealand and Ireland.

    There are considerations in Canadian law that suggest that it would be appropriate and that Canadians expect to see procedural fairness. They have an expectation that there will not be a single judge, jury and executioner, but rather that there will be an approach that allows for the investigative function to take place in a way that's unfettered, that allows for joint work and that allows for alignment and collaboration. Simply, on the imposition of monetary penalties, an expert body can focus on determining, on the basis of the investigation, as my colleague Ms. Angus pointed out, with deference to the commissioner's approach, and being able to take those decisions.

    The second point that I think my colleague already elaborated on very effectively is that when it comes to an appeal, the tribunal would have to give deference to the fact-finding and investigative results of the commissioner. That is actually a much improved situation for the commissioner and makes a much more streamlined and speedy process to land on a final outcome. If there were situations in which participants engaged in a scenario that the Privacy Commissioner was investigating and disagreed with the Privacy Commissioner, I think most Canadians would expect that there would be recourse or an appeal or a place to go and have that be adjudicated effectively by a body that has expertise in privacy.

    This is particularly as we increasingly encounter digital issues and digital market issues, privacy issues that can be quite complex to understand and perhaps beyond what a layperson would ordinarily experience. Having a body that is developing expertise in this space and is able to grow with the digital economy is, I think, a very core element of why it's a useful piece to have.

    Why have we not maybe looked at the Quebec model? In Quebec the Commission d’accès à l’information can directly impose administrative monetary penalties. Recently, a new bill was passed in Quebec that enables the Office de la protection du consommateur to impose administrative monetary penalties directly as well.

    Why did the federal government not look at what's being done in Quebec?

    The Quebec model is really very aligned with the model we're proposing. The main difference is that the tribunal is built into the CAI. The act for the CAI establishes several sections that have very clear purposes.

    There's an oversight division and an adjudication division.

     On top of that is the president's office, which is actually supported by eight administrative judges who act as an appeal mechanism within that. A case can come from the jurisdictional side for an AMP and be appealed. It's the administrative judges who support the president's office who actually can review that decision. It's actually a tribunal system that's built into the organization.

    What we are proposing is very much aligned with that model, except there is a structural separation between the two bodies that perform those functions.

     As you noted, the current system right now, which would be then appealed just to the Federal Court...or, sorry, to the sub-Federal Court—

     At this time, there isn't an appeal, because the OPC doesn't have any decision adjudicative powers. It's a de novo proceeding.

    However, in terms of the powers of the commissioner, which would be to issue orders and administrative monetary penalties going up to $10 million or 3% of sales, those powers will be in effect, no?

     I'm sorry. I'm not sure. Are you saying they would be in effect under the CPPA?

    Yes. The commissioner will have those powers to issue orders. The tribunal then, you're saying right now, is the only way to have recourse. If we take the tribunal away, there would be no recourse to the courts. Is that what you're saying?

     Depending on the decisions that this committee makes and how it's structured, I think there would be some potential challenges in terms of the implementability of CPC-9 as it's structured now, including with regard to part 2 of the bill. I think there would probably need to be several.... We would need to take some time to go through it again to see what the....

     I think what you're asking is what the default would be if the tribunal is removed. I think that there are issues of principle as well as of implementation that could arise. On the principles point, there's a principle of natural justice and administrative fairness that I think needs to be managed. I think you could still imagine a scenario in which we move through the federal courts and the Court of Appeal and the Supreme Court, which is kind of what we mentioned earlier.

    You would end up in a situation that is roughly analogous to today's, in that the decisions could be appealed. Each appeal would be a de novo proceeding. Each appeal would have to review the basis of fact to begin. That is going to be a more lengthy, drawn-out, challenging process than the one that would be undertaken under a tribunal system.

     Okay, so I'm going to let this go into more discussion from other members, Mr. Chair, but I think what I'm understanding is that we'd have to relook at part 2. I think that's the whole point of this amendment, that part 2 is about a tribunal.

    You know, a lot of what we do from our side is listen to the witnesses, specifically the current Privacy Commissioner and the former privacy commissioners when they're looking at the system, how it operates and how they'd like it to operate. More importantly, when we look at protecting Canadians' consumer rights, at a fundamental human right for privacy, we're looking at a system that looks at best practices across the world, not just reinventing the wheel. Specifically, from our side, we're looking at what's happened from the tribunal's and the competition commissioner's aspect and at how it hasn't worked or perhaps hasn't been working as well as we'd like it to.

     I'm going to leave it, Mr. Chair, that I still feel that the tribunal is unnecessary. I think we can go through better aspects to improve that process on the appeals system and the powers and, of course, give more power to the Office of the Privacy Commissioner.

    I'll leave it at that. Thank you, Mr. Chair.

    Thank you, Mr. Williams.

     I have Mr. Masse, Mr. Vis, Mr. Turnbull, Mr. Garon and Mr. Perkins.

    Thank you, Mr. Chair.

    I'd like to draw a picture, I guess, for people following this. How many members would be part of the tribunal?

    It's proposed to have six members, three of whom would have to have experience in information and privacy law. I think it's also worth pointing out that the proposed approach is to have them be appointed by the Governor in Council. They would not be ministerial appointees under the proposed act.

    Okay. What would happen, though, for example, if the tribunal split three to three?

    Don't worry if....

    There's a tie-break procedure. I just want to make sure that I'm getting it right before I respond.

    Yes. I'm just trying to paint a picture of the practical process for people who are—

    I understand. I'm sorry about that.

     No, that's okay. It's a pretty big bill.

    If you have another question, maybe we can come back to that one, if that's all right.

    Yes.

    Would these be full-time positions? What's the compensation? Can we get an idea of how this even works?

    One of the concerns that I have is that this also becomes a political appointee process that, you know, maybe doesn't have the right trust or can be influenced by industry. Those are legitimate questions, I think. I questioned some of the large companies that were here.

    The point is that it's three to six members, not six members firm—I apologize for that. Three of the members have to have expertise and experience in information and privacy law as a background.

     I'll have to get back to you on the question about the tiebreaker, but the positions would be full time or part time. I guess it's going to depend on the degree of volume that's moving through the tribunal system.

     It's interesting.

     Here's part of my concern. I'll just give you an example. With my private member's bill that's in the Senate right now, Parks Canada has this policy it's pulling, and it best described its own policy as trying to build, paint and fly the plane at the same time.

    What I'm worried about with this tribunal, if it's the same type of a process, is that perhaps in the future, if there is the will or the requirement, we could add the tribunal back for another Parliament if the system doesn't work very well for the Privacy Commissioner.

     To make sure I understand the question, it's whether the tribunal could be added to the system after the fact.

    Yes. I know it's a hypothetical. We can do anything, really, at the end of the day. It's a matter of legislating a change.

    The implementation question that would be most present, I think, before the committee is whether the other important aspects of the CPPA could be advanced in their current form without having the tribunal there, as it's currently built into a number of different portions of the act.

    As you see, the effect of CPC-9 is actually very broad and throughout part 1 of the act. I think it would be important to consider alternative mechanisms to achieve the policy intent that the tribunal would play in a number of different zones across the proposed amendment.

    Answering your question in the hypothetical about whether a tribunal could be added downstream is a bit challenging, because we would need to look at each and every instance in the bill where the tribunal currently plays a role and ask if are there alternative approaches that could be developed instead.

    I think that's the implementation challenge that the committee would face now.

     That's fair. I don't want it to appear that it's an easy thing to do later on. That's definitely not the case. It would require.... What I'm struggling with is whether or not introducing this is necessary at this time.

    I'll turn it to other colleagues to ask questions, but that's what I'm wondering at this point in time.

    Thank you.

    Mr. Vis, you now have the floor.

     This is a very important discussion, and I will admit there was very strong testimony received on both sides of the tribunal. If I understand it correctly, right now, the Privacy Commissioner has investigative powers. Those investigative powers would obviously still be retained if Bill C-27 were passed.

    I'm speaking hypothetically here. The Privacy Commissioner conducts an investigation. If this bill passes in its current form, the Privacy Commissioner will recommend to the tribunal an administrative fine for a breach of privacy. The tribunal will then have to decide....

     Am I correct so far? No. Please, correct me.

    In the proposed model under the CPPA, an investigation would be done by the Privacy Commissioner. The Privacy Commissioner would have the ability to enter into a compliance agreement that would have.... There are a number of outcomes that could happen.

    The Privacy Commissioner could issue an order and say, “I'm ordering this company to cease or desist a certain behaviour,” or, “I'm ordering this company to take this remedial action to improve its privacy management program and its practices.” They could enter into a compliance agreement whereby those requirements are featured and a financial discharge is also included.

    All of those things are possible and within the Privacy Commissioner's remit without the tribunal.

     Right. What about the cases when the tribunal is involved?

    The case when the tribunal would be involved is one when the Privacy Commissioner has gone through the entire process, may or may not have issued orders and then wants to recommend that an administrative monetary penalty be applied. He or she would then make a recommendation to the tribunal, on the basis of the facts of the case and the investigation, saying, “Here's the AMP that would be recommended.”

    The tribunal would specialize in narrowing down and deciding on the level of the administrative monetary penalty on the basis of the facts of the case as presented.

     Would the tribunal be commencing a de novo study of the issue at hand, or would it be solely based on the findings of the investigation conducted by the Privacy Commissioner?

     In a case in which the Privacy Commissioner is recommending an administrative monetary penalty, it would not be a de novo consideration by the tribunal. It would be about taking the facts of the case and identifying the right level of administrative monetary penalty.

    There is another point that I think is really important to understand here procedurally, which is that the Privacy Commissioner could go through the process and develop, for example, an order to say, “I'm asking this company to cease and desist this behaviour,” or, “I'm asking them to adjust their privacy management plan to change the governance structure.”

     If there were an appeal of that decision, the tribunal would hear that appeal, and again, it would not be hearing it as a de novo proceeding. They would have to give deference to the findings of the commissioner. It would not be relitigating the entirety of the findings or the investigation but reviewing it in a more narrow approach, as compared to if there were not a tribunal and the Federal Court had to take it on. It would be a different proceeding.

    I'll stop there for right now.

    Thank you, Mr. Chair.

    Thank you very much.

    Mr. Turnbull.

    Thanks.

    I'm happy to get into this debate. I wanted to challenge the claim that Mr. Williams made in his remarks, which was I think solely based on an argument that's claiming the tribunal would slow things down, add bureaucracy and make things less efficient.

    The way I'm reading it, and even in just what you responded to Mr. Vis, suggests to me that “deference” literally means that the evidence that was the result of an investigation by the OPC would be considered within the tribunal's work, whether it was an appeal or whether it was determining the right volume of an administrative monetary penalty.

    Could you unpack that for us? How is this.... I get the perspective that the Conservatives and some others are bringing up here. I get it: We don't want to add bureaucracy and slow things down. That is not the intention. My understanding is the tribunal would actually speed things up.

    I'll get to this after with a separate question, but I want to ask you about trust and administrative fairness and unpack that more. Let's just start with efficiency and eliminating bureaucracy, if you could unpack that for us.

    We believe that having a tribunal in place will increase the speed and efficiency of the process. The tribunal, unlike a court, is going to be required to give deference to the commissioner's decision. I think that's the important first piece to understand. What that means is that the tribunal does not need to start all over again, or de novo, when reviewing a file. It can consider and adopt the work and the reasoning that the commissioner has already done.

     That allows for a more streamlined and efficient process to move forward and, most importantly, the tribunal's decision itself will be considered final. That means it's not something that can be appealed to a higher-level court. Somebody could seek a judicial review of the decision, but a judicial review of a decision is far narrower. It does not reopen the findings of the case. It's about determining whether the decision of the administrative body was fair, reasonable and lawful. Generally speaking, what that means is that the court is being asked to review whether the tribunal acted within its authority or mandate.

     That is an entirely different scenario from going through an appeals process to various courts, relitigating and reopening the case at each stage and having new facts brought to bear. In that way, it would be expected to be resolved far more efficiently and sooner than if you're going through an appeals process.

    Thank you for that.

    I also understand that one of the other benefits of a tribunal would be the expertise of the individuals who are a part of that tribunal process.

     Can you speak to how, if you look at two possibilities—one where the tribunal is in place and one where there is no tribunal and one has to go through the Federal Court system—that would affect the timelines and perhaps the trust in...? I have in my notes, and I think you referenced it, Mr. Chhabra, a case with Facebook in which the OPC was deemed to maybe not have had enough evidence, or the quality of the evidence.... You can correct me if I'm wrong, but I just wonder how important it is, not only to procedural fairness but also to a speedy process, to have people with specific expertise in privacy.

    I think we've seen that these issues tend to be quite complex when it comes to personal information, data flows and how information is being utilized. It's not necessarily a straightforward proceeding. It's not necessarily one where a judge would typically have a significant amount of experience in previous case law to build from. There is, obviously, some case law in this space, but not to the level that might be considered a commonly understood approach.

    The speed element comes from making sure both that the tribunal's decisions themselves are considered final so that they're not being appealed but also that the degree of expertise resident in the tribunal is specifically designed to respond to stakeholder feedback that was received before Bill C-27 was tabled, about the importance of having at least three members of that group having expertise in privacy and information law. That is a growing field of law where experts have been developing their understanding of the issues and also of how emerging issues in the digital technology space, in terms of how data is being used, could have important effects on individual privacy.

    It's understanding the nexus of cybersecurity, understanding the nexus with de-identification or anonymization techniques, understanding the importance of governance approaches taken within organizations and understanding the approaches being taken in other jurisdictions as well. There are a number of reasons that having expertise in the domain of privacy law and privacy and information protection would be helpful for speed and to make the decisions more effective and procedurally fair.

     Thank you for those clarifications. I think your comments have helped me understand how specifically the tribunal would make the process more efficient and not more bureaucratic and laden.

    Let me back up for a second before I go forward. Do we know exactly how much more quickly things can move through a process of appeal, for example, in other jurisdictions where a tribunal is in place? Do we have any kind of idea of how a tribunal might shorten that timeline in comparison with going through a Federal Court process?

     Unfortunately, I can only answer in the most general sense. We obviously have all likely been exposed to court cases and appeals that can take many, many years to move through both the initial decision system and the follow-on appeal systems. It's possible for them to drag out for many years. Currently, the first-level court takes up to two years to engage. We would think that a tribunal could be much more rapid than that, particularly because it would cut down on the number of follow-on appeals that would go after the tribunal's decision.

     Thank you for that.

    I want to ask you another question, again to differ with Mr. Williams' opening remarks when he introduced the amendment. To use his wording, according to my notes, he said it would make us an “international outlier”. He also said there would be “delayed justice”, which I think we've talked about. I think he also said—I'm sorry, my notes are not as clear as I thought they were—that the efficacy of the OPC, the power of the OPC, would be somehow diminished by having a tribunal in place.

    I'm not sure that's true, based on my reading. My understanding is that what the CPPA is proposing gives the OPC quite a number of new authorities and powers that are above and beyond what the OPC has had in the past.

    Could someone just list and unpack the specific new powers? Then I have a couple of follow-up questions to that.

    New powers afforded to the commissioner would include the ability to issue binding orders following investigations. As I mentioned earlier, those could include an order for an organization to do something to comply with the CPPA. They could also include an order that an organization stop doing something that violates the CPPA.

    The commissioner would also have the ability to enter into compliance agreements. As I mentioned earlier, government amendments that have been tabled would allow for those compliance agreements to be entered into at any stage throughout the process and also for financial considerations to be included within that compliance agreement. That means, for example, if an organization were found to be in contravention of the CPPA, the OPC would have the power to negotiate a compliance agreement that could include, in essence, a financial payment or penalty.

    All of those things are new powers the OPC would have as a result of Bill C-27, which are not currently available to the commissioner.

    On the issue of alignment with other jurisdictions, as I pointed out earlier, we should always be very cautious about thinking narrowly about alignment on any one specific issue. We do see tribunals in effect in the privacy space in the U.K., Ireland, Australia and New Zealand, taking an approach that is very analogous to the one being taken here, with some slight variations across them, but again, every jurisdiction has its own constitutional framework and other laws in place that drive those slight variations.

    The point is that we are taking into account the best practices and the best approaches that have been undertaken internationally, and we are undertaking significant consultations here in Canada to bring forward a proposal that we think significantly improves the enforceability of Canada's private sector privacy law and gives the commissioner significant new powers to do so.

     Thank you for that.

    There are binding orders and compliance agreements that may include monetary penalties, and I understand that the tribunal would come into effect only if there were an appeal or there were some question around the rate at which to set that monetary penalty. Is that correct? Are those the only two cases in which the tribunal would come into play?

    That's right. I think in practical effect, you can imagine scenarios in which a company would not agree with the commissioner's position on what the compliance order should include, for example.

    If the commissioner were in a position of not being able to negotiate such a decision or outcome, the commissioner could then recommend an administrative monetary penalty to the tribunal, or the individuals or companies involved in the case could seek an appeal to the tribunal. As previously pointed out, those are the two points at which the tribunal could be engaged, and in both instances we find that it would be more efficient and effective than the alternative process would be.

    In some sense, is the tribunal actually enhancing the efficacy of the OPC's use of the new powers it would get as a result of the CPPA, or is this a check-and-balance situation in which those powers would be somewhat limited by the tribunal? I think what was implied was that, essentially, having a tribunal—at least as I understood Mr. Williams' intention when he made his comments—would somehow take some of the power away from the OPC, but I'm not sure that's the case.

    First of all, we've already established that the OPC is getting significant new powers. The powers the OPC would have as a result of the CPPA would be enhanced. Since the OPC did not have those powers in the past, it might make sense to build trust in this relatively new system in Canada to ensure that those powers are checked or have some limitations, but I can even speculate that there might be some ways in which the monetary penalties might be fairer as a result of having a tribunal look at how to set them at the right level.

    It's an open question. I really don't know exactly what the answer is. It's a legitimate question.

    I think it's probably best to consider it in two ways.

    One, when we talk about the ability to set the administrative monetary penalty, which would be done by the tribunal, I think you're quite right that it is a check-and-balance piece. That is about fairness. That is about expertise in setting the appropriate monetary penalty.

    When it comes to the appeals process, again, you're quite right that it would, in effect, speed up the finalization of an outcome compared to what it would be otherwise by following the court system. Because the decisions of the tribunal are final, there is significantly more speed and efficiency and effectiveness in getting to the outcome. One could suggest that actually the OPC's powers and the ability of the commissioner to get to a final decision and to influence what's happening in the market and to get companies to comply are in fact sped up and aided by having a tribunal system rather than having to work through multiple layers of court systems via appeals.

     Thank you.

    I have one other question related to this. I note that some other members on this committee have noted the number of cases that have been contested in the federal courts. Now, I think it's misleading to use that as a way of determining the volume of disputes there might be, given the fact that we're discussing here a new legislative framework. The old one in PIPEDA was 20 years old and didn't account for the digital age that we're in. It didn't account for many of the breaches in privacy that may happen more frequently throughout our economy today.

    I think when you're introducing a new legislative framework that comes with the OPC having new powers and authorities, and you have an old legislative framework not suited for the age we're in, my impression would be that there could be a lot more volume of disputes that both the OPC and the tribunal might deal with in the future once we, hopefully, get through installing this new legislative framework.

    Can you unpack that for us and whether you think that volume of disputes would likely increase in the future? Again, I could see a case to be made that if we think the volume is going to increase, which I suspect may be the case, then would we want all of those disputes to be going through a federal courts system rather than having a tribunal in place that significantly speeds up the process and gets to outcomes and increases trust and transparency in a system that is relatively new?

    I think it's very fair to say that the OPC is getting significant new powers. Those powers include order-making powers and the ability to recommend administrative monetary penalties, which are significant changes from the current approach wherein, as my colleague pointed out earlier, the OPC does not have those abilities.

    I think it's likely that companies may be more motivated to undertake appeals and try to seek different outcomes because of the nature of how they could be impacted by the OPC's new powers. I think it is quite reasonable to suggest that there might be more activity in terms of follow-on appeals.

     Chair, are we having a vote soon? I'm just double-checking the time.

    Well, we are supposed to, but the bells are not ringing.

    They're not. Okay. I'll keep going, then.

    My understanding is that other jurisdictions also have a tribunal in place. Mr. Williams was saying that we would be an international outlier, but based on my understanding and based on some of the things you've said already, that is not exactly the case. It may not be the case at all.

     Could you clarify for us any of the other tribunals and how things work in those other jurisdictions? I know you've mentioned New Zealand and Australia, but are there any others that you could reference?

    As you correctly pointed out in the question, Australia and New Zealand are both analogues we've looked at that have tribunal mechanisms. The U.K. has a tribunal mechanism that's organized slightly differently from what's being proposed under the CPPA. Again, as I pointed out earlier, different jurisdictions have different kinds of constitutional frameworks that can drive those differences.

    It's also important to recognize that when we're looking at analogues around the world, a lot of the privacy rule sets or legal frameworks have very different applications and very different scope, and therefore would necessitate different kinds of oversight mechanisms. A good example that we referenced earlier today is California, which has come up in this committee a number of times over the last few weeks. California's administrative monetary penalty regime is capped at between $2,500 and $7,500 per transgression. At that level, it may not be necessary to have a body of expertise dedicated to understanding the issues and determining the right level of monetary penalty that would be applied.

     In this case, under CPPA, we're talking about going up to $10 million or 3% of global revenues. That is a very significant impact. I think a degree of procedural fairness would be expected. That's why the tribunal is a core part of the government's proposal.

    Based on what you've said, there are administrative tribunals in the U.K., Australia, New Zealand and Ireland. You've pointed to the model in Quebec as being slightly different but effectively an administrative tribunal. I think there are other federal-level jurisdictions or areas. I think there are several other areas where administrative tribunals are used.

    Can you maybe talk about any of those other examples—within agriculture, for example, or any of the others that you know about?

     Certainly.

    I have mentioned tribunal models or administrative tribunals in spaces in Canada federally, like agriculture, transportation and international trade. I'll turn to my colleague for some specifics on those.

     The first one is obviously in competition as well, and I think we've talked about that.

    Another interesting example is the CRTC, which is also an administrative tribunal. What's interesting is that under Canada's anti-spam legislation, there is a chief enforcement officer who has all of the powers the OPC would have. They conduct investigations, issue notices of violation and make recommendations, potentially, for AMPs, but it's the tribunal that actually makes those decisions, again, as an oversight mechanism.

    Again, it's very similar to the CAI model in the sense that there is an appeal mechanism within the organization, like the CRTC, but it's in one organization as opposed to two different organizations. The Competition Bureau is another example in which there are two different organizations. There's the Competition Bureau and then there's the Competition Tribunal, which performs the same function.

     Thank you.

    On a slightly different topic, I think this amendment also removes the private right to action. Can you speak to the importance, from a principles perspective, of having that incorporated into...? That seems to be a pretty important piece of the legislative framework that hangs together.

     Can you speak to the importance of that?

    The importance of maintaining a private right of action has been raised by civil society stakeholders throughout the consultations that have taken place since 2018. It's also been raised as an important feature by the Office of the Privacy Commissioner.

    Because of the way the law is set up, although it's possible for the commissioner to recommend an administrative monetary penalty, that's not going to compensate an individual who may have suffered a transgression of the act on their own personal information. It wouldn't do anything to make them whole. What a private right of action does, as it's proposed in the bill, is allow the individual in that finding, on the basis of a decision and a finding of the Privacy Commissioner, to go and seek awards or compensation on the basis of the impacts they faced through the transgression of the law.

    Essentially, they wouldn't be able to seek rewards for breaches of their privacy as a result of this amendment. Is that what I'm hearing?

     If the proposed amendment in CPC-9 were to move forward, it would remove the ability for individuals to take a private right of action in these situations. That's right.

     It seems pretty counter to what I've heard some members on this committee say they would like to be able to protect, which is the fundamental right to privacy.

    I really appreciate your testimony. This is the last thing I'll ask, because it's still nagging in my mind.

    I think Mr. Williams and Mr. Vis implied that the OPC doesn't want a tribunal. I think Ms. Angus said that's not exactly correct. Can you just square that for us, because it seems like it's a fundamental disagreement here?

     Where does the current Privacy Commissioner, Mr. Dufresne, who I have a lot of respect for...? I would love to know how we ensure....

     What is the Privacy Commissioner's perspective on the tribunal? Can you give us just the highest overview of that again? I know you've already told us, but it seems like there's a difference of opinion about what the Privacy Commissioner has said, and it would be helpful just to clear that up once and for all, if possible.

     Sure. Last year, the Privacy Commissioner published 15 recommendations that were his top priorities or top changes that he wanted to see in the CPPA, and none of them requested the removal of the tribunal. He requested two things. One was with respect to the tribunal and one was with respect to his other enforcement powers.

    With respect to the tribunal, what he said was that he would prefer the tribunal decisions be appealed to the Federal Court of Appeal rather than the Federal Court, which is currently the system. As we've said, it's not an appeal, it's a judicial review, so it's not quite the same thing. Skipping a step is not really going to make it faster, because it's not an appeal.

    The second recommendation was about giving more flexibility with respect to compliance agreements. Specifically, he wanted to be able to enter into a compliance agreement at any point in time; he wanted financial consideration, so the equivalent of AMPS, to be part of the compliance agreement that he could conclude, and there are government amendments to that effect.

     Is there any residual disagreement in terms of what the OPC has recommended and the approach currently being taken in the CPPA?

    It would be the OPC recommendation that asked for the decisions of the tribunal to go to the Federal Court of Appeal that we would not do. My understanding is that it would require an amendment to the Federal Courts Act, which is not under consideration at this time. We couldn't amend the Federal Courts Act to that effect.

     At the same time, from a policy perspective, that's not necessarily going to speed up the process, because, as we've discussed, it's a judicial review and not an appeal.

    To clarify again, the OPC did not ask for taking the tribunal out of this legislation.

     That is correct. The current commissioner did not ask for that.

    Okay. Thank you.

    Thank you very much, Mr. Turnbull.

    Mr. Garon, go ahead.

    Thank you very much.

    I want to go back to what Mr. Turnbull said. Some good questions have been raised, and that's necessary for debating purposes.

    We've discussed at length the number of cases the Commissioner has handled under the present legislative framework. I've questioned the parliamentary secretary, the minister and the deputy minister on the subject. We can agree that amending the act could increase the number of cases and expand the case law, for example, which raises the matter of expertise.

    To my mind, expertise has to be acquired at both the Commissioner's office and the tribunal. I think this is a something of a side issue. We're interested in knowing what expertise has been built at the Commissioner's office.

    How many of the Commissioner's decisions have been challenged in Federal Court, and how many of those were invalidated?

    It's important first to point out that the Commissioner doesn't currently have decision-making authority. The Commissioner publishes an investigation report that contains recommendations and if the business doesn't want to comply with them, that's when the Commissioner or complainant can take the business to court.

    We looked into this issue and found that, from 2003 to 2024, some 50 decisions concerned an investigative report prepared by the Commissioner and that, in 70% of those cases, the court did not agree with the Commissioner's findings and investigation report.

    More recently, in a case involving the Commissioner and Facebook, the Federal Court found that the Commissioner had not discharged his burden of proof. He hadn't really made his case. It should also be noted that the Commissioner appealed that decision. As we said, since that's obviously a long process, we'll have to see how long we have to wait for a final decision in the case. It doesn't always happen that way, but it nevertheless happens often enough.

    So that's what I was talking about.

    Out of personal interest and for the committee's benefit, I'd like to have those statistics and a list of those judgments, if that wouldn't trouble you. I have to say I previously made that same request in private and didn't get the information I asked for. However, I know one mustn't disclose private conversations.

    Earlier, Mr. Chhabra said that

in most cases, “the commissioner loses”.

    So the Federal Court has apparently invalidated many of the Commissioner's findings, and we want to create a new tribunal based, among other things, on the allegation that the Federal Court doesn't have the necessary expertise.

    Explain that to me. I'm not a lawyer, but, logically speaking, I think that's a dubious justification.

    It's a matter of effectiveness and expertise, Mr. Garon.

    I'm asking you the question precisely because that has happened many times.

    You said we need a new institution, new people nominated, a new tribunal and a new building because the Federal Court doesn't have the necessary expertise.

    Here's my reasoning. My own impression is that creating this new institution might have the effect of discrediting the Commissioner. We're told we need a new tribunal that has the necessary expertise. The stated justification for that is that the Commissioner's decisions are often invalidated by the Federal Court, which therefore has the necessary expertise to do so. However, if we tell you we prefer to go directly to the Federal Court, we're told it doesn't have the necessary expertise.

    For someone for with an IQ over 80, that's completely illogical.

    Thank you for your question.

    We have to acknowledge that there are two distinct elements here.

    First, there are administrative monetary penalties. Then there are appeals. Those are two separate elements.

    In my opinion, the necessary expertise on penalty-related decisions could be developed within the tribunal.

    However, your view is that—

    Just a moment, Mr. Garon.

    Colleagues, as you can hear, the bells are ringing for the vote. Since they started around 6:42 p.m., the vote will be held near the end of the meeting. The meeting was supposed to conclude at 7:12 p.m., but I propose we adjourn around 7:05 p.m. so that all those who wish to go to the House to vote have time to do so. Having said that, I need the unanimous consent of committee members to continue the meeting to around 7:05 p.m.

    Do I have the unanimous consent of the committee?

     That's until about seven o'clock. Are we good?

    Some hon. members: Agreed.

    The Chair: Okay. Thank you.

    I didn't mean to interrupt you rudely, Mr. Chhabra, but I think it's important to use our time wisely, particularly since things are going smoothly today, which is quite rare.

    I don't understand how that expertise could be developed from scratch at a new tribunal but not at the Office of the Commissioner.

    Once again, thank you.

    We don't draw a distinction between the expertise of the Commissioner's office and that of the tribunals. In fact, the newly created tribunal would respect the Commissioner's expertise by virtue of the fact that it would have to attach considerable importance to the Commissioner's decisions.

     In other words, the tribunal is providing more respect to the expertise of the commissioner by deferring to the facts, decisions and determinations made by the commissioner.

    The second point about expertise is that the tribunal would see all of the cases related to privacy infractions and breaches. They would build that expertise, awareness and understanding over time, versus a scenario in which a court—any court and any judge—could be sought to sit on a given case. That is a very significant distinction.

    It's about expertise in at least three ways in this case: the expertise to develop a facility to identify the right administrative monetary penalty; the expertise resident in the commissioner that becomes more respected because the tribunal must give deference to the commissioner's findings and facts; and the expertise in the tribunal itself, which becomes a much more expert body in hearing these appeals because it sees every single privacy—

    All right, I understand.

    What you're telling me—

    I'd like to continue my answer, with your permission, Mr. Garon.

    In the GDPR, which is the European system of general data protection regulations, Ireland has a system whereby its privacy regulator can't levy a fine directly. They must go to seek an adjudicated body to determine the level of the fine.

    They have the highest level of GDPR fines in Europe, so the ability to work through these processes doesn't necessarily in any way suggest that you're going to have reduced fines, as may have been suggested at this committee earlier today, or that you're going to have slower decision-making. What we see internationally is just the opposite, in fact: The commissioner's work is actually strengthened by having an expert tribunal working on these issues exclusively.

    So you're essentially telling us that, if we create this new tribunal, it will be able to build expertise faster than the Federal Court because its judgments will concern a limited number of matters.

    To my mind, that doesn't rule out the possibility that the same thing will happen at the Commissioner's office.

    Let's move on to something else. You mentioned the duty of deference and said that the Commissioner's role wouldn't shrink, as it were, because the tribunal created under the bill would defer to the Commissioner's decisions and would only assess administrative monetary penalty amounts.

    Is my understanding correct?

    The tribunal would have two purposes: to determine appropriate administrative monetary penalty amounts and to adjudicate appeals.

    Earlier someone said, or at least suggested, that the new tribunal would be empowered to establish fairer, more appropriate or more equitable penalties and would have to uphold the decisions made by the Commissioner. However, subclause 103(1), which concerns the disposition of appeals, provides as follows:

    So that's not entirely true. Perhaps you can explain the legal term “consideration” to me, but that's not what was suggested earlier today. It was suggested that the Commissioner would be able to make recommendations and that the tribunal would have the necessary expertise to determine monetary penalty amounts. In reality, however, the new tribunal wouldn't really have greater expertise since, ultimately, it would simply be able to invalidate what the Commissioner had decided. It's written here in black and white, in subclause 103(1), and I repeat:

    I'd like to clarify two points. First, subclause 103(2) provides:

    That's where the idea of consideration comes into play. The idea is to determine the applicable standard. When we say that the applicable standard of review is correctness for questions of law, it's a very strict standard, but the applicable standard for questions of fact and mixed questions of fact and law is palpable and overriding error. Consequently, in such cases, it must really be demonstrated that the Commissioner—

    I understand.

    We also discussed the expertise that would be established, but the tribunal will in fact already have expertise when it's established since the three to six members who would constitute it under the bill would already have to have expertise in the field. Consequently, expertise wouldn't necessarily have to be built.

    In recent days, we've seen examples in Quebec of judges whose expertise could be doubted.

    Can you tell me what could prevent us, as legislators, from stating in the bill and amendments that this standard of review would apply to the Federal Court?

    On the one hand, from a very technical point of view, I think you would have to amend the Federal Courts Act because it's the legislation that prescribes how the Federal Court reviews decisions.

    On the other hand, from an administrative law standpoint, there are certain principles of justice. Consequently, you would have to clarify, as is being done in Quebec, the roles and responsibilities of each clause to distinguish investigative and adjudicative functions. Then you would have to specify what standard the Federal Court would apply having regard to the structure of the organization.

    I'd be very curious to know more about the subject. I sense that we may not be voting today, which will give us a chance to learn more about it.

    That being said, the bill provides for the enactment of three statutes. It's hard to pity a government that would have to amend a fourth for it all to work. Please pardon my lack of sensitivity.

    Thank you.

    Go ahead, Mr. Perkins.

     Thank you, Mr. Chair.

    Would you consider the federal Privacy Commissioner to be an expert in privacy and privacy processes?

    I think that's a fair statement.

    Would you feel the same way about provincial privacy commissioners?

     Again, I think that's a fair statement, but I would rather not engage on it in the generics.

    When we think about the different powers that each of those commissioners has and the different systems in which they function.... For example, they don't all have the ability to impose administrative monetary penalties. Alberta and B.C. are examples of that.

    That's fair enough, but I just wanted to establish that—

     Therefore, when we're talking about degrees of expertise, I think it's important that we be really clear about where the expertise lies—

    I have a point of order.

     I don't want to interrupt, but can we just let the witness finish his answer?

     I have only five minutes until we adjourn, and he's not answering the question I was asking.

     Rick, I'm really respectful. If you wouldn't mind letting him finish answering without cutting him off, I would appreciate it.

    Could you wrap that up so I can get on with it?

    Thank you, Mr. Turnbull.

    A point of order is not a debate between MPs, but, yes.... Please, Mr. Perkins, allow Mr. Chhabra to conclude his thoughts.

    Thank you, Mr. Chair.

    I was simply trying to make the point that it's important that we think about domains of expertise very specifically. We are talking about a specific question. Make sure the voices we're talking about in that question are actually avowed experts in the area they're talking about.

     If we're going to be talking about things like having a tribunal, for example, or having an administrative monetary penalty regime—

    Let me pose my questions, if I could. Thank you.

    I understand all of that, and there are different systems, but privacy commissioners all talk to each other. They're not some sort of independent, isolated person. In fact, they talk to each other around the world.

     I'm sure you've read this, but in the current Privacy Commissioner's submission on Bill C-11 in 2021, he wrote:

    He mentioned a particular section in the previous bill.

    He continued:

    We've had a lengthy discussion on that already.

    He continued:

    That's from the previous bill, Bill C-11, which has been put forward again.

     When the Privacy Commissioner appeared before this committee on October 19, 2023, he said:

    He's an expert, but that was also shared by the former privacy commissioner when he appeared before this committee. He also pointed out that every provincial privacy commissioner opposes the tribunal. In fact, specifically, the Information and Privacy Commissioner of Alberta stated before this committee, at meeting number 104, that:

    There's a lot of opposition to this. That's what we've heard. I'm at a loss to see.... Almost anybody who's an expert in this has said this will lengthen the process and make it more difficult—everybody except the government.

    I think we've been really clear in explaining our rationale for why we think it would be more efficient in this model. I think we've also been really clear to note that in some cases the provincial commissioners don't have the power to issue administrative monetary penalties.

    The previous commissioner was reacting a number of years ago to a different bill and a different approach. The current Privacy Commissioner has outlined an interest in seeing compliance agreements be more flexible in their approach. The government's amendment does in fact propose to make that a feature.

    As my colleague Ms. Angus pointed out earlier, the ability to change the level of appeal to the Federal Court of Appeal rather than the Federal Court, which is also something that Commissioner Dufresne has pointed out, is not something that can be done in this proceeding, because Bill C-27 doesn't actually open the Federal Courts Act.

     The other approaches that Commissioner Dufresne has highlighted have in fact been taken on board. Our conversations with the Privacy Commissioner suggest that there is an openness and an understanding of why this could be important. In fact, in his most recent testimony to this table, the OPC himself suggested that:

    Even in his own testimony before this committee, he did in fact raise that issue and acknowledge that there could be good reasons for doing so.

    I would also point out that in your commentary earlier, the way it was presented made it seem like the commissioner could not act quickly. In fact, the exact opposite is true under CPPA. The commissioner can act quickly to issue orders, both compliance orders and stop orders.

    This notion that somehow this tribunal function would slow down the ability for the commissioner to act in situations that are requiring speed is not the case, and this notion that somehow investigations or joint investigations would be impeded only because of an administrative monetary penalty, which, by the way, would always be set distinctly anyway.... The ability to collaborate on an investigation is not at all hampered by having a tribunal in place. The only thing the tribunal is responsible for is determining the ultimate amount of any given administrative monetary penalty.

    I've noticed the clock, and we're going to vote, but I just want to say, because I'll continue on this at the next meeting, that that wasn't my presentation. That's the testimony of the Privacy Commissioner. I just want to correct you there, because you made it seem like it was mine. I was quoting the Privacy Commissioner.

    On this note, I'm sure we'll have the chance to continue this interesting discussion.

    Thanks to our witnesses for being with us today, and we'll see you next week.

    This meeting is adjourned. Thank you, everyone.