Question Period Note: BILL C-27 / DIGITAL CHARTER PRIVACY REFORM

How will the Government of Canada’s proposed legislation help better protect Canadians’ privacy?

• The Digital Charter Implementation Act was designed to uphold trust in the handling of personal information, create new rules for businesses that use or operate AI systems and meaningfully advance Canada’s Digital Charter.

• The Bill proposes to improve privacy protections for Canadians with special considerations for minors and to encourage responsible innovation.

• It also proposes to create a new risk-based framework for AI systems in Canada and a new regulator to enforce the Act as well as set serious penalties for noncompliance.

• Actions proposed in Bill C-27 represent the most significant change to Canada’s private sector privacy law in 20 years.

In respect of privacy reform, Bill C-27 builds on legislation proposed in the previous session of Parliament under former Bill C-11 and addresses concerns raised by stakeholders with respect to that Bill. It proposes the creation of the Consumer Privacy Protection Act (CPPA), which would replace Part 1 of the existing Personal Information Protection and Electronic Documents Act (PIPEDA), and establishes the Personal Information and Data Protection Tribunal to provide a necessary review mechanism in light of the extensive new enforcement powers under the CPPA.

The CPPA is rooted in three core pillars:
1. Enhancing individual control by supporting meaningful consent, the right to request deletion of personal information and data mobility frameworks.
2. Supporting strong enforcement and oversight by expanding powers for the Privacy Commissioner including order-making powers and ability to recommend penalties. The Commissioner can recommend administrative monetary penalties (AMPs) up to 3% of an organization’s global revenue - or $10 million – for each contravention of the Act.
3. Supporting innovation by providing exceptions to consent for collection and use of personal information necessary for business activities, internal research & development, clarifying rules for de-identified information and recognizing code of practices and certification programs to provide greater assistance and clarity for organizations to comply with the Act.

Budget 2023 allocated $21 million over 5 years to the OPC to undertake more in-depth investigations of privacy breaches across public and private organizations, to improve response rates to privacy complaints from Canadians and operationalize new processes required to implement the Consumer Privacy Protection Act.

Bill C-27 also recognizes that the effectiveness of data protection is tied to the interoperability of Canada’s privacy regime vis-à-vis domestic and international arrangements that support the transfer of data and knowledge. As such, it is drafted taking into consideration the interoperability of Canada’s federal privacy regime with that of provinces such as Quebec’s Law 25 and European Union’s General Data Protection Regulation.

It also proposes the Artificial Intelligence and Data Act (AIDA), a new law that would make Canada a global leader in responsible artificial intelligence (AI) development and assure users that AI systems used in Canada are safe. Companies that make available for use or operate high-impact or general-purpose AI systems would have to identify and mitigate risks of harm and biased output, and ensure appropriate testing and monitoring, among other requirements.

AIDA creates a new regulator, the Artificial Intelligence and Data Commissioner and sets out strong penalties for noncompliance, including Administrative Monetary Penalties (AMPs). The Act is designed to be regularly updated via regulation, to keep up with the pace of technological development. Budget 2024 allocated $5.1 million in 2024-25 to stand-up the AI and Data Commissioner office.

AIDA is designed to be interoperable with international AI laws such as the EU’s AIA, and is aligned with international principles and definitions, including those of the OECD.

The Bill was referred to INDU for study in April 2023 and the Committee commenced its study of the Bill in September 2023. Clause-by-clause consideration of the Bill began in April 2024.

• This Bill proposes important steps to ensure Canadians will be protected by a modern law that keeps pace with today’s technologies and sets clear rules for businesses to guide them as technology continues to evolve.
• Specifically, the Bill will introduce significant new measures to better protect the privacy rights of Canadians, including special privacy protections for minors, heightened enforcement powers, and significant penalties for non-compliance, with funding in Budget 2023 for the Privacy Commissioner to implement this robust approach.
• Bill C-27 also proposes an Artificial Intelligence and Data Act which will regulate high-impact artificial intelligence (AI) systems, such as those that determine access to employment and healthcare, as well as create guardrails to address the potential risks from general-purpose systems.
• The Government will be able to update it regularly via regulation in order to align with international partners and keep pace with the rapid development of AI technologies.