Industry Committee on April 29th, 2024

[Brian Masse, NDP, Windsor West, ON]

Great.

Thank you, Mr. Chair, for the time. It's been very helpful to get to the comfortable zone of supporting this amendment. I think it's appropriate.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Masse.

Mr. Généreux, the floor is yours.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Thank you, Mr. Chair.

Does any other legislation in Canada provide for authorized representatives for young people under the age of 18?

[Mark Schaan]

At this time, no federal legislation defines the age of minority or majority. The only age defined is the voting age, which is set at 18. However, that has nothing to do with the concept of majority.

Bill C‑63 on harmful content online is currently proposing that the age of majority be set at 18 in the digital world.

That said, right now only the provinces and territories, based on vital statistics, determine the age of majority and minority in Canada.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

The Canada Elections Act is clear. Minors are people under the age of 18. If I'm not mistaken, under this legislation, young people aren't adults before the age of 18.

[Mark Schaan]

A citizen's voting age is determined solely by a government decision. It isn't really related to the concept of the age of majority or minority. No section of the Canada Elections Act states that only adults can vote. The voting age is simply set at 18. In this context, the age of minority or majority isn't defined, nor is the concept of a child or adult. It's just about the ability to vote.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

I agree. However, it's also a concept to set, in a bill of this nature, the age of majority at 18, meaning the age up to which people are subject to privacy legislation.

I've had conversations with people of various ages about the age at which individuals can make decisions for themselves. Of course, the answers differed, because the views vary from person to person.

I'm thinking back to the early 20th century, or even to 35 years ago, when the Internet didn't exist. I don't know how old you are, but I'm 62. We didn't have the communication tools 25 years ago that we have today. Does this make us smarter? I'm not sure. When we were teenagers, we didn't have the same tools. These days, a number of young people have access to these tools from a very early age. In some cases, it's almost dangerous. In my opinion, having access to these technological tools doesn't make young people any more responsible.

Based on my conversations on this topic, the age of 18 is still a given, in theory. The legislation could say 14, 15 or 16. However, 18 is the generally accepted age in western countries. In a way, it's only natural.

We propose that the bill set the age at 18. This isn't binding. Obviously, it would require young people to obey the law. However, it would give us greater leeway. When we legislate, we must think about young people who are more sensitive, more open to attack, in a way, or more naive. No matter what we call them, we have a duty to protect these young people. In a way, we play the role of guardians of these young people. For that reason, we think that this amendment is important, even though Quebec's law 25 sets the age at 14.

In terms of consistency or compatibility, I would like to know the age established in various pieces of legislation both in Canada and abroad in the United States or the European Union.

[Mark Schaan]

At the international level, a number of approaches establish rights and responsibilities with regard to children's personal information. For example, the children's code in England sets the age of majority at 18. The Canadian bill is perfectly compatible with this approach.

We must acknowledge that, for the purposes of this bill, age matters because any information concerning children or minors is sensitive.

Compatibility won't really be an issue. The organizations in Canada will comply with the provisions set out in Bill C‑27, which recognizes the sensitive nature of children's information. Since Canada sets a high standard, this lays a good foundation for complying with all the other legislative approaches in different countries. If the provisions set out in Bill C‑27 are adhered to in Canada, the organizations can comply with the legislation in effect in England, and maybe even in the European Union.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

In this case, wouldn't the age limit of 14 be too restrictive?

[Mark Schaan]

Obviously, in our view, 14 isn't old enough. The personal information of teenagers aged 15 to 18 is also sensitive.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Okay. Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Généreux.

Mr. Savard‑Tremblay, the floor is yours.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

I just want to clarify something to make sure that I understand the amendment.

First, you compared the bill to practices in other parts of the world. I should point out that, in Quebec, the age is 13. It's even lower than the originally proposed age of 14.

Suppose a young woman or young man wanted to have negative information about themselves removed. According to the amendment, I gather that they would absolutely or quite likely need to do so through their parents. Is that right?

[Mark Schaan]

I gather that, if this amendment is adopted, the rights and remedies will fall to the parent or guardian when the minor child lacks the capacity or desire to exercise them. However, if the teenager has the capacity to do so, they can exercise their rights and remedies.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

I just want to make sure that I understand. How is “capacity” legally defined?

[Mark Schaan]

This term is widely used by the courts. There are precedent‑setting capacity tests to determine, based on certain factors, whether a person has a certain capacity.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you.

Since there are no further comments on amendment CPC‑4, we can vote on it, unless there's unanimous consent to adopt it.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

I would like a recorded vote.

[The Chair, Liberal, Joël Lightbound]

We'll proceed with a recorded vote.

I should point out that, when moving his amendment, Mr. Vis changed it so that the age would be 18 and not 14 as it appeared in the paper version submitted.

(Amendment agreed to: yeas 10; nays 1 [See Minutes of Proceedings])

[The Chair, Liberal, Joël Lightbound]

Thank you, colleagues.

This brings us to amendment CPC‑5. Before Mr. Perkins moves it, I must inform you that…

Are you not moving CPC-5, Mr. Perkins?

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Yes, Ryan is.

[The Chair, Liberal, Joël Lightbound]

Just before Mr. Williams moves it, I want to inform members that should CPC-5 be adopted, BQ-1 will be inadmissible due to a line conflict.

I'll let Mr. Williams move CPC-5.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you, Mr. Chair.

I want to reference all amendments, because I think they're really important. In this discussion, when we're talking about personal information, we have our first amendment, which talks about including inferred information about an identifiable individual. However, I think it's important in my discussion of this that we also recognize some of the other amendments. Perhaps through this discussion—I know there will be a vote—out of four, I think we can probably come to an agreement of some kind of consolidation of this, as we've done with past amendments.

I'll start with what we're talking about. We talk about personal information as “information about an identifiable individual”, but when we're talking about AIDA and the age of AI and big data, we've identified that we also need to make mention of inference.

The Privacy Commissioner has said:

...inferences can lead to a depth of revelations, such as those relating to political affinity, interests, financial class, race, etc. This is important because the misuse of such information can lead to harms to individuals and groups in the same way as collected information—a position confirmed by the Supreme Court in Ewert v. Canada. In fact, as noted by the former European Article 29 Data Protection Working Party, “[m]ore often than not, it is not the information collected in itself that is sensitive, but rather the inferences that are drawn from it and the way in which those inferences are drawn, that could give cause for concern.”

He continued:

General support for the idea that inferences constitute personal information can be found in past OPC decisions and Canadian jurisprudence. For instance, the OPC has found that credit scores amount to personal information (PIPEDA Report of Findings #2013-008, among others), and that inferences amount to personal information under the Privacy Act (Accidental disclosure by Health Canada, paragraph 46). This is also consistent with the Supreme Court’s understanding of informational privacy, which includes inferences and assumptions drawn from information.

We've had the Privacy Commissioner give past cases on this.

He continued:

In light of these conflicting viewpoints, we believe the law should be clarified to include explicit reference to inferences under the definition of personal information. This would be in accordance with modern privacy legislation such as the California Consumer Privacy Act (CCPA)...

Looking at this, I normally note the GDPR as being the gold standard. We think the California example is the better example for personal information.

To go further into that, when we talk about personal information, one limitation of the definition is its broad scope, which can encompass a wide range of data, including information that may not always directly identify an individual. This can lead to ambiguity and challenges in determining what constitutes personal information, especially in cases where data points are combined or analyzed in aggregate.

Additionally, the definition may not adequately address emerging technologies and forms of data, such as IoT devices or anonymized data—as we've talked about before—that could potentially be reidentified.

Besides the inclusion of inference, to improve the definition to look more like the California example, it could include specific criteria or examples to clarify what qualifies as personal information. Additionally, incorporating provisions for emerging technologies and data types would enhance its applicability and reference.

To look at how it's defined in the California code, this is how it reads right now. Personal information includes, but is not limited to, any information that directly “identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household”.

It then includes examples, which I think are really important. It says this includes, but is not limited to, names, postal addresses, email addresses, social insurance numbers, driver's licence numbers, passport numbers, financial account numbers, credit card numbers, biometric information, geolocation data, Internet protocol addresses, device identifiers, browsing history and any other information that could be reasonably used alone or in combination with other data to identify an individual or household.

We talk about how it's much better to talk about human information when we talk about privacy, because it refers us back to human beings, but giving examples allows the Privacy Commissioner, when looking at cases, to look at exact examples, and then in a court of law to have those more defined.

Mr. Schaan, I'll start with you. Starting with the inferred information as defined in this amendment we're talking about, does it constitute the same protection as personal information throughout the entire bill, even with this proposed amendment?

[Mark Schaan]

Mr. Chair, I want to thank the member for his question.

As we understand it, CPC-5 codifies the existing interpretation of “personal information” by the OPC—which, as the member has noted, has also been codified by the Supreme Court—that includes inferred information, so we see this as consistent with the current approach. It codifies it in law as it is currently, both jurisprudentially and as understood by the regulator.