Bill C-27, the Digital Charter Implementation Act, 2022, was raised for debate at second reading in the House of Commons on Friday, November 4. The bill would enact the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act (PIDPTA), and the Artificial Intelligence and Data Act (AIDA). Read our complete summary of the most significant aspects of Bill C-27.

The Liberal government laid out its case for the bill on Friday, stating that Parliament must enact substantial privacy law reform to bring Canada's privacy regime into the 21st century.

While opposition parties agree with the principle of Bill C-27, they highlighted numerous areas of concern and are pushing for a thorough study of the bill at committee.

"Consumer trust" was a key theme during debate in the House of Commons. Study and deliberation moving forward will likely focus on how private sector organizations – and legislators – can improve consumer trust through measures contained in Bill C-27.

The Standing Committee on Industry and Technology (INDU) will study Bill C-27 if it passes second reading.

The government's position

Minister François-Philippe Champagne, Minister of Innovation, Science and Industry and sponsor of Bill C-27, stated on Friday that the bill serves four principal objectives:

  1. Gives people more control of their data online;
  2. Protects children's information;
  3. Addresses the responsible use of artificial intelligence (AI); and
  4. Brings Canada's privacy laws into the 21st century.

In his speech in the House of Commons, Minister Champagne stated that Canada would be among the first countries in the world to pass comprehensive legislation on AI if Parliament passes the AIDA. In response to media questions about criticisms of the AIDA, Minister Champagne asserted that the government consulted widely when drafting the proposed legislation, and will not be deterred from pursuing the passage of AI provisions in Bill C-27.

Minister Champagne stated in his speech that he is most proud of Bill C-27's protections for children's information. The CPPA would define the personal information of minors as "sensitive," which would carry more extensive obligations for the collection, use, and disclosure of that information.  

Minister Champagne emphasized that Canada would have some of the toughest penalties for non-compliance with privacy laws in the G7 through new enforcement provisions contained in the bill.

He further argued that the bill effectively balances privacy interests with the need for responsible innovation. The Minister suggested that this is particularly evident in the introduction of a "legitimate interest" exception to consent, including an associated backstop. The AIDA also promotes responsible innovation in the Minister's view, because the act would build trust and mitigate risks presented by high-impact AI systems (high-impact systems are not currently defined in the bill, but will instead be defined later through regulation).

Minister Champagne noted that it is critical for Canada to maintain its adequacy status under the European Union's General Data Protection Regulation (GDPR). Modernised privacy laws will serve this objective.

He urged the House to send the bill to committee.

Opposition concerns

Opposition parties expressed varied concerns about the bill, although all recognized the need for privacy law reform.

The Conservatives firmly stated their position that Bill C-27 should entrench a fundamental right to privacy. When Conservative Party MPs posed questions to Minister Champagne on this topic, he noted that the preamble to the bill acknowledges such concepts. The Conservatives replied that explicit statutory entrenchment of the right to privacy is necessary.

The Conservatives advocated for strengthening de-identification provisions contained in Bill C-27, arguing that complete anonymization of personal information in applicable circumstances should be the standard instead.

Conservative MPs also argued that the legitimate interest exception in the bill is too broad as drafted, leaving too much discretion for businesses to determine when to invoke the exception to consent rules. They referred to GDPR legitimate interest provisions as a preferable model, asserting that these are more limited.  

The NDP expressed their concerns about the composition of the Personal Information and Data Protection Tribunal (the "Tribunal"). NDP members specifically questioned whether tribunal members appointed by the government, as provided for under the PIDPTA, could be strategically appointed and accordingly overrule enforcement decisions by the Privacy Commissioner of Canada for political purposes. In response to questions on this topic, Minister Champagne argued that specialized tribunals are common, and procedural justice would always be protected. He also noted that tribunal decisions would be subject to judicial review.

The Bloc Québécois and the Conservatives believe that certain parts of the bill are entirely inadequate. Notably, there were numerous calls to either scrap the AIDA entirely or split it from C-27 and draft a new bill on AI. The Conservatives argued that the proposed legislation was rushed, subject to inadequate consultation, and leaves too much discretion to regulations, the Minister, and delegates. The Bloc Québécois said that there is insufficient logical connection between the objectives of the AIDA and the other acts contained in Bill C-27; they suggested that the AIDA should be a separate bill altogether.

The Bloc will support the bill at second reading but want a robust study at committee. They prefer a prescriptive model for legislation, more akin to the GDPR, and want the adequacy of Québec legislation completely respected. Bloc Québécois MPs will seek further clarification from the government about how provincial legislation will be treated if C-27 is passed, especially in jurisdictions that currently have laws that are recognized as being "substantially similar" to PIPEDA, meaning that federal private sector privacy legislation has limited application in those jurisdictions. 

Conclusion and next steps

Second reading of Bill C-27 will continue at a later date.

Minister Champagne wishes to see this legislation passed with some urgency, but opposition parliamentarians appear committed to thoroughly studying the bill, seeking input from stakeholders, and making substantial amendments if necessary.