INDU Committee Meeting

    I call the meeting to order.

    Good afternoon, everyone. Welcome to meeting number 126 of the House of Commons Standing Committee on Industry and Technology.

    Today's meeting is taking place in hybrid format. Pursuant to the Standing Orders and the order of reference of Monday, April 24, 2023, the committee is resuming consideration of Bill C‑27, Digital Charter Implementation Act, 2022. Today, we are continuing clause-by-clause consideration of the bill.

    Before we begin, I would like to remind all members and other meeting participants in the room that it's important to keep their earpiece away from their microphone when it's on, and to familiarize themselves with the guidelines that are written on the cards on the table. The health and safety of all participants is at stake, especially the interpreters. I therefore ask you to act accordingly, and thank you in advance for your co-operation.

    Today, Wednesday, we welcome back Mr. Samir Chhabra, director general, as well as Ms. Runa Angus, senior director, both from the Department of Industry's Strategy and Innovation Policy Sector.

    Mr. Chhabra and Ms. Angus, thank you for participating once again in the committee's clause-by-clause study of Bill C‑27.

    Before turning the floor over to Mr. Williams, who had the floor while we were debating amendment CPC‑9 and Mr. Perkins' subamendment, I'm going to give the floor to Mr. Garon, since he asked me for a few minutes to talk about the motion he gave notice of on Monday.

    Mr. Garon, you have the floor.

    Thank you, Mr. Chair.

    I think most of us have been made aware of the GLENTEL affair: two cellular giants have, through a joint venture, obtained a monopoly in Loblaws grocery stores. In this context, I think it would be important for the committee to address the issue of competition and the business models that can undermine it.

    I know the committee has done a lot of work on the grocery store issue, and I think we need to do the same with the cell phone market. You have all received the motion, of which I gave notice on Monday, May 27. I don't intend to debate it today, but I'd like to table it and read it. Here's the text:

    Thank you very much, Mr. Garon. I should point out that the motion had not been tabled, in fact. You had only given notice of it.

    Mr. Turnbull, you now have the floor.

     Thanks, Chair.

     I'm sorry I can't be with you all today in person, and I have to join remotely.

    I just wanted to say I'm generally supportive of Mr. Garon's motion. The topic is an important one. Perhaps we can study it. We've certainly said all along that we would continue to work on and prioritize Bill C-27. I'm hoping we can agree to that. I know we're not debating it today, but I just wanted to signal to him that we're supportive of studying this, but would prefer to do so after Bill C-27, if possible.

     Thank you.

    Thank you, Mr. Turnbull.

    Mr. Masse, you now have the floor.

     Thank you, Mr. Chair.

     I want to thank Mr. Garon for this.

    I wrote to the Competition Bureau commissioner with Jagmeet Singh, and we have received an acknowledgement that they have it and are looking at the situation. Of course, they don't act on political direction, but they have acknowledged that they have the request and they know of the issue. We wanted to confirm that.

     We can circulate the correspondence I just received yesterday from the competition commissioner.

     Thank you.

    Thank you very much, Mr. Masse.

    (Clause 2)

    The Chair: We now return to clause 2 of Bill C‑27 and amendment CPC‑9.

    Mr. Williams, you have the floor to debate Mr. Perkins' subamendment.

     Thank you, Mr. Chair.

    Welcome back to everyone who is keeping tabs on Bill C-27.

    For those listening at home, we're still working on the amendment on private right of action, an amendment that we're looking at to reinstate at least one line of that. I just wanted to make a few points that I was trying to end with at the last meeting, when we talked about why we believe the powers should be going to the Privacy Commissioner and what private right of action actually means in terms of taking away the tribunal and giving that power to the commissioner.

     I believe it means an increased accountability for organizations. A private right of action would create a direct legal route for individuals to seek remedies for privacy violations, therefore increasing accountability of organizations, which is really important when we look at the Privacy Commissioner having that power but also at the ability of those individuals who are going through the Privacy Commissioner first to then take their own legal remedy against organizations that violate their privacy.

    We talked about resource allocation for the Privacy Commissioner and the fact that perhaps the Privacy Commissioner would be overburdened. We all know what's happening with the Information Commissioner right now, who has asked for extra funding and is backlogged and is not getting that funding from the government. This would allow individuals to take legal action for privacy breaches and reduce the number of cases the Privacy Commissioner has, even though the commissioner should be getting more funding, depending on the caseload.

    There's a deterrent effect in the possibility that facing private lawsuits would act as a deterrent for organizations considering lax data protection practices. The ability to have this through the Privacy Commissioner, of course, would be a deterrent.

    On the empowerment of individuals, we've talked about making sure that privacy is a fundamental right. When you give this power to individuals, you're empowering individuals to take action and control their privacy rights, which I think is a very important part of this bill. We perhaps could have a faster resolution of complaints compared to administrative processes handled only or solely by the Privacy Commissioner's office or by the tribunal.

     We think this will enhance privacy awareness. As individuals take legal action, it raises public awareness about privacy rights and the importance of data protection, the more that this gets into the hands of those individuals.

    There could be a reduction in systemic violations. The threat of legal action from multiple individuals could encourage organizations to implement more robust privacy practices, reducing the likelihood of systemic privacy violations and reducing the overall burden on the Privacy Commissioner.

    It goes on and on, but moreover, I think it's a complementary role. The private right to action serves as a complementary mechanism to the Privacy Commissioner's oversight, ensuring a more comprehensive and multi-faceted approach to privacy protection.

     When we're looking at this, I think we all agree that this should be going first to the Privacy Commissioner, that the Privacy Commissioner should be the first step, but that private right of action is really important in giving that power to the Privacy Commissioner so the commissioner can handle and administer fines and we still have the option of the courts. Then we would find that the tribunal would be unneeded.

    I'll leave it at that, Mr. Chair.

     Thank you, Mr. Williams.

     Do I have any other speakers? Mr. Vis, were you on the list?

     We have Mr. Vis and then Mr. Masse.

    In his testimony, Mr. Geist talked about whether a tribunal of this sort would be respected. He said there was a lot of public skepticism after the Rogers-Shaw deal.

     Just to clarify, because the amendment we have before us today will ultimately impact other parts of this bill, if a tribunal heard a case and then it had to go to court, would the court start de novo on the issue at hand?

     Thank you very much for the question.

    The way the CPPA is structured now, a tribunal's finding would be considered firm and final and could not be appealed to a court. It would only be subject to a judicial review, which, as we discussed last meeting, is a much different standard, and could only be reviewed on the basis of essentially the tribunal acting in a manner that was outside of its mandate.

     During her testimony, Diane McLeod spoke about the complexity this will provide for provincial jurisdictions with respect to joint investigations with British Columbia, Ontario and Alberta, specifically.

    What does the department say in response to Ms. McLeod's testimony, which I'm sure you're aware of and which I think contains a very valid point?

     Thanks again for the question. As we have discussed over the last couple of meetings, there would be no impact on the investigatory functions of the Office of the Privacy Commissioner as a result of having a tribunal available. The tribunal would have two main functions, as we discussed recently. The first would be to make decisions about administrative monetary penalties that would be recommended by the Office of the Privacy Commissioner, and the second would be to form a body to hear appeals of those decisions.

     It would have no impact whatsoever, as far as we're concerned, on the ability of the Privacy Commissioner to enter into joint investigations, to develop investigatory approaches with provinces, and to share data and findings. In fact, in many places throughout the CPPA, we have taken pains to ensure that opportunities are made available for data and information sharing on the basis of the Privacy Commissioner's working with other regulatory officers, including the competition commissioner.

     Since Ms. McLeod represents the privacy office in Alberta, would the department at least acknowledge that right now the provincial commissions have a view that is different from that of the Department of Industry with respect to joint investigations, despite the assurances you're providing? Is that fair?

    I'll ask my colleague Ms. Angus to provide a bit more detail on that point.

     I want to clarify Ms. Diane McLeod's testimony. She did say, “Our informal case resolution team operates separately from our adjudication team. When a file moves to inquiry, our adjudicators conduct a de novo hearing.” What I want to say is that, in Alberta, there is this separation between the adjudicative and the investigative functions that is just not there in the CPPA with the way it's currently structured, and that's not brought in by the amendment.

    Ms. McLeod also said, “We are concerned about whether the inclusion of the tribunal as an appeal body to the Privacy Commissioner's orders would impact our ability to conduct joint investigations.”

    Will the department acknowledge that, as it is right now, the privacy commissioner of Alberta still has outstanding concerns about the ability of the Privacy Commissioner, in conjunction with the tribunal, if this legislation passes, to conduct joint investigations, and that there needs to be some work between Industry Canada and those respective provincial bodies to find a mutually agreeable approach if investigations are going to go forward in the future?

    What we heard—and we haven't heard anything different from the privacy commissioner of Alberta—is that right now their interpretation is different from yours.

    Thank you for the question. I certainly am prepared to acknowledge that there are multiple perspectives and viewpoints that could be taken on this point. However, I think an informed reading of the proposed bill that's been put before this committee for consideration would make it very clear that there are no impacts on the partnership or joint investigation work.

     The role of the tribunal that's been put forward is circumscribed to very limited activities and is really designed to ensure that there is procedural fairness and that there is impartiality in the system, which, as the committee would well understand, is a constitutional guarantee. As Ms. Angus just pointed out, even the Alberta system has a separation between the investigatory and adjudicative functions built into the system. For that reason, it's critical to ensure that as the Privacy Commissioner moves from having an ombuds function towards being an actual regulator with teeth—let's call it for lack of a better term—there is an element of procedural fairness and impartiality built into that system.

    Failing that, there is an extremely high likelihood of overturning these decisions based on constitutional grounds or constitutional challenge or based on a lack of impartiality on the part of the OPC. For that reason, actually instituting the tribunal is an important mechanism by which to reinforce and strengthen the OPC's ability. If we imagine a scenario in which there is no tribunal, it's very likely that any finding of the OPC or any action of the OPC, including the levying of an administrative monetary penalty, for example, could be overturned on constitutional grounds, and that would send us back to a situation of having a toothless regulator, which I think is broadly understood to be the state of affairs that we're trying to move away from.

     Thank you. I'm going to follow up with the privacy commissioner of Alberta. I want to hear further from them about their position on what was stated, but I take your comments in good faith.

    May I add just one further point on that, if that's okay?

    Yes. Thank you.

    I just want to point out a specific section of the act, in case it's helpful regarding your question. That's proposed subsection 119(2), which allows the OPC to enter into agreements with the provinces.

     Thank you so much.

    Dr. Scassa, from the University of Ottawa, spoke in October about the independence of the appointed tribunal. It's my understanding that there will be six members of the tribunal. Is that correct, or is it five?

     Thanks very much for the question.

     The tribunal as proposed would have between three and six members in total. At least three of those members must have experience in the field of information and privacy law.

    They would be appointed by the GIC and also have the remuneration fixed by the GIC. The maximum term would be five years. They could be reappointed for one or more terms, not exceeding three years each. They could be full- or part-time members.

     The chairperson would supervise the distribution and assignment of members to hear matters brought before the tribunal, which could be heard by panels of those members as well, if considered appropriate.

     Three would have to be considered privacy experts, but would the other—possibly up to three—members of the tribunal be subject to a GIC appointment, or would they be appointed directly by the minister of industry?

     Thanks again for the question. All would need to be appointed by the GIC.

     I was just specifying that at least three members would need to have experience in the field of information and privacy law.

     I will note for the record that Mr. Therrien did say that this tribunal would “create delays”—this is more of a comment—would be “duplicative” and that there's no international precedent for this.

     Perhaps you can challenge Mr. Therrien's comments on the framework that the department is trying to establish in this legislation, and whether there is in fact an international comparison that we as MPs can draw upon for further review as we move forward with this.

    Thank you very much again for the question.

     I'll begin and then perhaps ask Ms. Angus to add in as well.

    I believe that over the last couple of meetings we've highlighted a number of other jurisdictions. In fact, I'd like to back up for a second and start by pointing out that it really depends on the specific question that we're asking. If we're asking a question about whether other jurisdictions separate the investigative and adjudicative functions, the answer to that is almost universally yes.

     Whether we're looking at the U.K. or Ireland, as we gave examples of last time, or Australia or New Zealand or Singapore, almost all have a system or a mechanism in place to separate the investigative and adjudicative functions—in other words, avoiding a scenario in which you'd create a judge, jury and executioner all in one office.

     In Ireland, as we mentioned previously, the privacy regulator is not able to levy penalties directly. You can seek those from a court or a public body. They actually have the highest level of fines levied under the GDPR, the general data protection regulation of the European Union. In New Zealand, costs and damages may be awarded, but they have to go to a human rights tribunal to seek those. Singapore also has a separation. I could go on and on. France also has a two-tier separation system.

    It's very common, not just in Canada but also internationally, to have some degree of separation between a body that conducts an investigation and develops findings and a body that makes a final determination about a penalty, for example.

     Would it be a fair description to note that the separations you've just outlined in many of those other jurisdictions are contained within one body but two separate entities, whereas we're creating essentially two separate institutions? Is that a fair description?

     There are scenarios in which they are in the same body, but expert tribunal models are used in the U.K., Australia, New Zealand and Singapore, so a variety of approaches are undertaken. Again, as we mentioned in the last meeting, there can be constitutional grounds for that. Attempting to just sort of pick out one feature and to do a comparison can be a little bit tricky, because doing that doesn't necessarily take in the full scope of understanding of the constitutional grounds upon which that framework is based. Therefore, we tend to look at it as a whole and to understand how it functions in its totality.

    To answer your question in as straightforward a way as I possibly can, it depends on the jurisdiction. Many have a separation between the two bodies. Some have bodies that are unified but have separations or firewalls built into the organizations that separate investigation and adjudication.

    At the moment, the Privacy Commissioner does not have that separation built into their functions. Our analysis was that it would be very difficult to establish that inside the body of the Privacy Commissioner as it stands today, in part because of its responsibility for the Privacy Act as well. In other words, the Privacy Commissioner is responsible not just for PIPEDA or in the future for CPPA but also for administering the Privacy Act. There are more challenges associated with covering that and with having this separation built into the Office of the Privacy Commissioner itself.

    Thank you.

    Just going back to the appointments, I do find it somewhat concerning—even though they are GIC appointments, and we know how GIC appointments work in this country—that only three people would be needed to be experts on privacy. That means up to 50% of the tribunal won't have to be experts. It could be Joe Blow off the street, theoretically, or someone close to whoever is in power at a certain time.

    Do you believe or does the department understand that the way the GIC appointment process could work for the tribunal could lead to individuals' being appointed who have no business being on a tribunal that could be responsible for levying significant fines on global corporations?

    It's important to point out that the GIC appointments process is rigorous. There are safeguards in place in terms of the approach that's taken and the recognition that there are also complementary skill sets and experiences that could actually benefit a tribunal in coming to its conclusions. Individuals with deeper experience in other forms of law or in technology or with an engineering or a software engineering background could be helpful.

     That would be in an ideal world, and that's the problem. We know how GICs work in Parliament. It's unfortunately not as rigorous as you describe it to be, but thank you.

    Finally, if this legislation passes in the next fiscal year, there will be no major change to the Privacy Commissioner's budget. How do we intend for the Privacy Commissioner to take on all of these new roles in this legislation without having an increase in budget? They won't have the regulatory teeth you just mentioned without having the financial backing behind that. Why didn't the department recommend increasing the funding for the Privacy Commissioner in anticipation of this legislation?

    I will note that Sustainable Development Technology Canada, which is under a stop-work order from the minister, had billions of dollars allotted to it even though it's not an operating body right now.

    Thank you very much for the question. It's a really important one in terms of the resourcing of the Privacy Commissioner. In fact, the department and the government did anticipate this need and took action early. In budget 2023, the resources available to the Privacy Commissioner were increased substantially. I don't have the numbers in front of me, but I believe there was more than $20 million over five years, and that was done very much in anticipation of this work coming.

     What is the Privacy Commissioner's current budget?

     I apologize, but I don't have that figure at hand. I can certainly bring that back for discussion.

    Is it fair to assume that it is approximately $25 million to $29 million?

    A voice: It's $26 million.

    Mr. Brad Vis: Is it $26 million to $30 million over the next five years, or is it going up from $26 million to $30 million and then subsequently to $34 million in the following year?

    I'd be very pleased to come back to the committee with a written response on exactly how the funding flows are designed to function.

     I will note that the Privacy Commissioner, when he appeared before our committee, asked to have his budget doubled, so the Privacy Commissioner would disagree with the department's understanding that he has, in fact, been given the resources he asked for.

    Thank you. That's all for now, Mr. Chair.

    Thank you very much, gentlemen.

    Mr. Masse, you now have the floor.

     Thank you, Mr. Chair.

    I hear what's being said about the tribunal, but I really don't believe that a black hole in the earth will open up and swallow us all through it if we don't create a tribunal.

    Some hon. members: Oh, oh!

    Mr. Brian Masse: I've raised it with the minister from day one on this legislation. I understand there is a logic behind creating it. I mean, it's not something that's unworthy of looking at.

     Do we even have a budget estimate for staffing on the tribunal?

     Just to be clear, the tribunal will be supported by the administrative tribunals support services institution, which already supports about a dozen other tribunals. It's not a question of creating a tribunal machinery from scratch. It's very much going to be supported by an organization that already exists and that already provides services to a number of administrative tribunals.

     It joins, I guess, a group of other tribunals. I guess I'm not as familiar with this. I'm a New Democrat and we don't get appointed to GIC positions. That's just the reality of how this place works.

    Where I'm at now, though, I think is important, because I've listened really carefully. I want to be open so that other members of the committee figure out where we're going on this. For me, I've always been open to considering the tribunal, and I haven't been presented a good enough case for it. I know there are some benefits to it. There is no doubt of that, but I still believe.... I think if there are resources lacking, then resources should go to the Privacy Commissioner, because I prefer building a model where the Privacy Commissioner has the first solid ground on this and then, following that, there's a process to go to the courts.

     I've heard even from the past testimony we've had that, no matter what, we can always end up back at the courts—no matter what. For me, where I'm trying to work on things is..... People can sue, so I disagree with...but anyway, I'll let my friend explain that later.

    For me at any point, what I'm looking for is a model, and it's why I'll support the amendment to abandon the tribunal as part of this legislation but to build one where the Privacy Commissioner has the first right of action, investigation and so forth. Then, if there's a case beyond that, a case that somebody wants to bring to the courts, they can do that. I don't believe that at this point in time, for this legislation, the tribunal is the right move.

    I just want to make that clear for members, because I have an upcoming subamendment to adjust that part of the legislation we have.

    Thank you, Mr. Chair.

    Thank you to the witnesses.

    Thank you, Mr. Masse.

     I have Mr. Turnbull next and then Mr. Van Bynen and Mr. Badawey.

     Mr. Turnbull.

    Thank you, Chair.

    Thanks to our devoted witnesses for being here yet again for another great debate. Thanks for all of your testimony, which I think helps elevate our debate and certainly provides us with a good perspective on the various topics that we're diving into.

    I know that we're technically right now debating a subamendment that Mr. Perkins put forward to an amendment that was originally moved by Mr. Williams. I think Mr. Williams' amendment looked to remove all references to the tribunal from the legislation, and I believe that Mr. Perkins' subamendment was to try to almost doctor and put back in the private right to action. However, then I think there's some talk about striking a portion of that, which perhaps was unintended, if I'm not mistaken.

     Chair, maybe you could just review where we're at, because I don't want us to get lost. It seems like a lot of our debate seems to be relating back to the original amendment and is not necessarily focused on the subamendment. I'd like to try to stay focused on dealing with one issue at a time, even though I get that the broader debate is on the tribunal as a whole.

    Could you just clarify that for me, Chair?

    Yes, Mr. Turnbull, you're entirely correct on where we are.

     I believe last time we talked about how this creates a bifurcation, that what Mr. Perkins proposed would essentially create two potential pathways for individuals to pursue.

    One would be through the OPC, which I think was originally contemplated to be the main interpreter of this law, and then this would create another track where someone essentially would be able to go through the court system. I hear the argument that, yes, some things could still end up in the court system. I get that, but I think that having the OPC and the tribunal set up seems to streamline the process so that less would be needed to be heard before the courts.

     I guess what I'm trying to come back to is that I think there are some significant points that we heard on the concept of natural justice being so important to how this legislation was crafted. To me, I think that, as a core set of principles, that seems to be at the heart of the debate we're having with regard to both. It's coming up with regard to the subamendment but also with regard to the amendment.

    I want to give Mr. Chhabra, perhaps, a little bit more time to just go into the details of.... Again, my understanding of natural justice is that it's supposed to maintain public confidence in the legal system and that it is a set of principles where you're supposed to be able to, to the greatest degree possible, remove bias and have a right to a fair hearing. However, there may be other pieces of it that he would like to highlight.

    Could you maybe speak to that? It could be either one of you, so if you would like to contribute too, Ms. Angus, that would be helpful.

    Thank you.

    Perhaps I'll get started, and Ms. Angus can add in if she has additional points to add.

    I think it's a really important point that you're raising, and it's one that we've been trying to elaborate for the committee's benefit over the last couple of meetings.

    Any institution of this nature, whether in Canada or in comparable democracies abroad, would, by design, build in some procedural safeguards, build in impartiality and ensure that, in Canada in particular, the constitutional requirement for a fair and impartial hearing has been met. In the case of CPC-9, which seeks to remove the tribunal in its entirety, you are left with a scenario in which the Office of the Privacy Commissioner would be first prioritizing the investigations, prioritizing what to go in and investigate, and then conducting the investigation, taking decisions on the basis of the investigation and, in this case, levying very significant administrative monetary penalties as contemplated under the CPPA.

    That approach, in our view, would open the OPC's findings and decisions to constitutional challenges in court. As we've previously highlighted, going to court is a more costly, time-consuming exercise, and it would be a de novo proceeding where there would be no deference paid to the commissioner's findings.

    In addition to that, the risk of having the constitutional challenge result in the case being dismissed is quite significant. If that were to be the case, you'd essentially be back at square one, where we are today, where you'd have a toothless regulator without the ability to effectively govern and kind of guide companies' activities in the market.

     I'd just like to add one point, and that is what the courts themselves have said about administrative tribunals. My colleague discussed how the process for going to the courts can be expensive and long, and I just want to say that the Supreme Court of Canada has also recognized that. In Vavilov, which is sort of the seminal case with respect to administrative law, the Supreme Court itself said that:

    This is the Supreme Court of Canada itself acknowledging that administrative tribunals allow access to justice in a way that's faster and cheaper than it would be able to, so I think that's an important point to make.

     Again, that's coming from the Supreme Court of Canada. You would think it would carry some weight in terms of our debate if the Supreme Court of Canada itself recognizes the value of administrative dispute mechanisms like the tribunal and that it actually enhances.... Does the tribunal really just enhance access to justice in a sense? I mean, is that a stretch or am I reading too much into it? Is that really what we're sort of saying? That it enhances due process, helps to remove or maintain impartiality or removes bias...?

    Can you maybe speak to that? I get that your argument hinges around it. This is part of the disagreement here and the debate we're having. Some are saying that this tribunal is going to add bureaucracy and delay things, and I think that's the opposite of what I hear your expert testimony telling us, which is that it is not going to do that. It's going to be less cumbersome, less expensive and get to a resolution faster.

    Could you speak to whether this enhances due process and removes bias?

     There are a couple of elements in your question that I think are worth unpacking.

    I think the first is to understand that the tribunal would come into effect or be engaged in a case only where an appeal was sought by an individual involved in the proceedings, and it is designed to provide that procedural fairness and that recourse mechanism in a way that is much more efficient than going to the courts. It does both: provides the procedural fairness aspect and does so in a manner that is more accessible, less costly and certainly less time-consuming.

     When you recognize especially that the tribunal would have the ability to take final decisions that could only be judicially reviewed, as opposed to being appealed themselves, and if you compare that to a hypothetical case where it's going to the courts, you would have the court, the Court of Appeal and the Supreme Court all as potential bodies that would be engaged in hearing an appeal, which, as we know, would take many years to resolve.

     That's why, as the proceedings have continued here, we've tried to take pains to point out that, in fact, establishing the tribunal gives the OPC more power, more authority and more leeway, as well as more credibility, and certainly reduces or very much minimizes the risk of the Privacy Commissioner's finding being overturned as a result of a lack of impartiality in the process.

    This isn't about any kind of accusation of bias on the part of any officer or office-holder. This is really about respecting the Constitution and understanding that impartiality needs to be enforced, that it needs to be built in structurally and that proceedings and procedures need to have that basis if they're going to be testable in court and they're going to be sustainable in that environment.

    The commissioner today, as we pointed out before, plays an ombuds function, plays an education function and plays an advocacy function and an engagement function. These are all important elements of the way that the Privacy Commissioner is empowered to do his job and to fulfill the role.

    It's important to recognize that attempting to turn that into something much more adversarial is a significant challenge. As we've pointed out earlier, if there were attempts made to adjust the office and to put in place safeguards within the organization, that could be quite challenging, given that the Privacy Commissioner also has responsibility for enforcing the Privacy Act. It could also make it much more difficult for the commissioner to engage with companies and with Canadians to play the advocacy, support and ombuds function that he already does play.

    Using the tribunal as the mechanism to hear appeals and to make final decisions with regard to administrative monetary penalties allows the commissioner to continue playing the important roles that he plays today. It also adds significant enforcement powers, as we've discussed before, including the order-making powers, which are very significant.

    It's also important to note that the government amendments that have been tabled to this committee also would give the commissioner the ability to enter into compliance agreements, which would obviate the need to go to the tribunal at all. If the parties were so willing to engage on that compliance agreement, the commissioner would have the ability to negotiate not just fines but also damages, which would in fact eliminate the need for somebody to take on a private right of action or take on a separate case civilly, because in fact they could be made whole through the compliance agreement process itself.

    In a number of different ways, we've thought through very carefully how to create a system that is robust, that is efficient, that is effective and that meets the standards required for the decisions to be upheld by a court.

    Do you want to add anything?

     I would add to my colleague's point that the OPC, in addition to the order-making powers, has the ability to engage in alternative dispute resolution mechanisms, including mediation and conciliation. That is another avenue the OPC can use, which obviates the need for parties to go to a tribunal. The OPC has ample powers to resolve disputes before even going to the investigation stage. In fact, it does. The OPC actually resolves about 70% of complaints through alternative dispute resolution mechanisms.

    Thank you for that. It was very helpful. I even learned a couple of things that I wasn't all that clear about prior to this, so thank you for your testimony.

    What I'm stuck on here is the comment you made about what's being proposed in terms of the subamendment. If an amendment were to pass and remove the tribunal altogether, it essentially opens up any of the OPC's decisions to constitutional challenges. That seems like it could really erode public confidence in the OPC's decisions and findings.

    Would it not do that over time, if that became a fairly regular occurrence? To me, it would be very tough to maintain an OPC with the powers that are contemplated within this bill. Is that not the case?

     Thank you very much for the question.

    I think the consequences can actually go further than that. If there is a charter or constitutional challenge, the enforcement system—as contemplated by CPC-9—does not meet principles of natural justice and does not guarantee perception of a free and independent hearing. The court may render certain parts of the enforcement inoperable. This may mean that a lot of the new powers we're giving to the OPC through the CPPA may be rendered inoperable, which then brings us pretty much to the current situation, which is an OPC that has an ombuds role but doesn't have a lot of enforcement power. It becomes a toothless regulator, as my colleague said.

    That was the number one piece of feedback we've heard from stakeholders since 2018, as we've been consulting on this: What we need is an OPC with more significant enforcement powers. That's what we've done through the CPPA. Of course, with more powers, there has to be an accessible mechanism for oversight that has a constitutional guarantee of respecting principles of natural justice.

    The current version of the act tries to balance all of those different considerations in a way that's accessible, flexible and improves outcomes for all Canadians.

     Thank you for that. That sounds like it makes sense to me.

    It sounds like removing the tribunal not only makes any appeal process more costly, more time-consuming and perhaps less effective but also opens up the possibility for constitutional challenges, which may remove the teeth from the OPC. Those sound like pretty significant unintended consequences of simply saying, “Well, we don't like the tribunal. It seems overly bureaucratic or something.” It's very tough because, at this point, I think your testimony has provided such great, detailed evidence for why this is truly needed. However, I don't sense that my colleagues on the other side are being swayed by the very good and in-depth arguments being made.

    Some of the things that came up in some of the other aspects of this conversation, or in other parts of it, were joint investigations or interjurisdictional collaborations, let's say, between the federal OPC and the provinces or territories. Mr. Chhabra mentioned proposed subsection 119(2), I think, about agreements with provinces and territories.

    Could you go into that a bit more and reassure us that some part of the bill allows for and contemplates joint efforts as both possible and maybe even encouraged where needed?

     What proposed subsection 119(2) does is allow the OPC to enter into agreements or arrangements with the provinces to do a number of things. They can collaborate on research and they can collaborate on guidance, but more importantly, they can coordinate their activities to provide for mechanisms for the handling of any complaint in which they are mutually interested. That's the part that authorizes joint investigations and allows them to collaborate on investigations quite consequently.

     By the way, they already do that, so this is a continuation of what the OPC is already able to do, and this wouldn't change under the CPPA in any manner.

    Thank you for that. That's very helpful. I think that could reassure folks who may be skeptical about the OPC being able to collaborate effectively on joint investigations or other activities that are within his or her purview.

     The other thing that strikes me is that one of the things that is hard to compare is how long an appeal would take through the court system and how much more costly it would be compared to going through the administrative tribunal route. I can't remember how many times Mr. Williams said in his original opening remarks that justice delayed is justice denied. I was thinking the whole time—and am still thinking, at this very moment—how we're hearing very clearly that the tribunal is not going to delay justice. What's going to delay justice is not having a tribunal, because the tribunal is going to speed up the process and remove and compress the timeline.

    How do we know that, though? That's what I'm looking for. Do we have any evidence and documentation of this that could be submitted to the committee?

     I know it would be hard to do a comparison because you wouldn't take both routes, but maybe there's some way to show and reassure folks who are skeptical about that, because we've heard quite a few arguments that members opposite think it is going to delay justice, it is going to be more bureaucratic and it's going to add a layer that's unneeded.

     I think having any additional evidence and data on that would be very helpful. Is there anything you could provide to further substantiate the fact that the tribunal will actually make things more effective, speed things up and make them less costly?

    Sure. I'm happy to respond. Thank you for the question.

     Our understanding is that, at the moment, it takes two years on average for a case to reach the very first court, which is the Federal Court. As I'm sure many of the members of the committee are familiar with, it can take many years beyond that to go through the follow-on approaches of the Federal Court of Appeal and then to go to the Supreme Court.

    I'll take a moment to draw a bit of a contrast to the Competition Tribunal, because it's been raised in this committee in recent days to make a comparison between the speed or efficacy of one tribunal versus another.

    Again, notwithstanding the fact that they would both be administrative tribunals in nature, the commissioner of competition and the Competition Bureau have quite different approaches and powers from those being contemplated here under the CPPA. The Competition Bureau has no power to issue orders or administrative monetary penalties, whereas the OPC under the CPPA would have the power to issue orders without going to the tribunal and the power to recommend administrative monetary penalties.

     The Competition Tribunal conducts “first instance” adjudication and imposes those orders in AMPs. By contrast, the personal information and data protection tribunal would hear appeals against the OPC's findings and compliance orders and decisions. It's a very different approach. The Competition Tribunal shows no deference to the Competition Bureau, whereas the tribunal, in this instance, must apply a deferential standard.

     Appreciating that some committee members have raised concerns about efficacy or approaches in comparisons to other existing tribunals, I just wanted to put on the table that this is, in fact, structured to be quite different in its approach.

     Ms. Angus will add a bit to that.

     I just wanted to add perhaps some more context.

     In the case of the Social Security Tribunal, that tribunal is supported by the administrative tribunals support service system, which we have contemplated would also support the tribunal that is contemplated under Bill C-27. Again, compared to the two years the OPC is currently facing, the Social Security Tribunal heard cases in 2021 to 2022, for example, in 43 days.

    There is a very substantial difference between the time in which a specialized tribunal can hear a case as opposed to the courts. That's something that, as I mentioned earlier, the courts themselves have recognized.

     What I hear from that is that not all tribunals are created equal in the sense that they're different and that some of them can move faster than others. What assurances can we have that the tribunal that's contemplated in this particular legislation would be faster than that two-year appeal process in Federal Court? Obviously, if cases went beyond that, which they wouldn't necessarily have to, it would take many more years. Is there an estimated timeline?

    I imagine it's probably hard to say, at this point, because it doesn't exist. You'd want to stand it up and have it function for a while to get a sense, probably, of how long things would take to get through the tribunal. Do we have any way of knowing whether the tribunal contemplated in this case would take much less time than two years on the average case?

     I think Ms. Angus in fact provided probably the best estimator available, which is to look at how quickly other tribunals are able to get to cases as a way of estimating how this one would operate. You're thinking about a dedicated group of resources with expertise in the issues, who are able to be deployed to cases rapidly. Of course, it depends on how many cases are being brought forward to the tribunal and how active the Privacy Commissioner may be with the new powers granted. It's very difficult to estimate what the overall caseload would be.

    The approach that's been taken here is meant to ensure efficiency in at least a couple of ways. One is to have a dedicated group of experts who grow their expertise over time in dealing with these cases so that they're able to move through them much more quickly and efficiently. It's also to avoid follow-on levels of appeal, which is a very significant difference. Because their decisions can only be judicially reviewed, that eliminates many years, potentially, from a follow-on process. In so doing, I think it offers a much more robust yet efficient approach.

     Thanks. I appreciate that.

    It sounds as though it might be more along the lines of the Social Security Tribunal that you were mentioning. Certainly those follow-on processes through the court system would have a very extended time period. I understand that, because the only recourse after the tribunal would hear an appeal would be a judicial review, which is very different from the other path, as we were discussing, through the court system. That's interesting.

    I think you were implying—and I just want to maybe get you to draw this point out a little bit further—that the OPC's new powers, which include the ability to impose the monetary penalties that are being proposed in this legislation, are really significant because they include the power to form compliance agreements and others. Significant power will be vested in the OPC as is contemplated in this bill. That is all the more reason perhaps to have a tribunal, given the principles of natural justice that having that investigative and adjudicative function in one office-holder or one person, the OPC, would perhaps be perceived as having too much of a concentration of power with no check or balance to that power.

    That to me is what you said. I'm putting it in my own words, but would you like to maybe just clarify whether that's actually what you meant to say and whether or not I'm misinterpreting? I think that's what I heard you say, that the new powers vested in the OPC, which are above and beyond what perhaps other commissioners have, with the significance of the penalties, etc., justify having a sort of check and balance built into the system to ensure that natural justice can be preserved.

     Thank you. I think that's a very accurate encapsulation of the testimony we've provided.

     That's all for me.

    Thanks.

     Thank you very much, Mr. Turnbull.

    I now have Mr. Van Bynen.

     Thank you, Mr. Chair.

    I'm not a lawyer, so I probably need some things clarified. That's probably a good thing. I've had some experiences with tribunals, particularly in my 12 years of being a municipal mayor. Actually, I'm of the view that these tribunals happen to expedite the situation. They allow us to develop expertise, as we've heard over and over again. I've seen them work effectively, particularly in the province of Ontario. I have some concerns around the uneven playing field that we're looking at in the absence of a tribunal.

    For an issue going to the Privacy Commissioner, what would that cost? My vision of an infringement of privacy is that it will likely involve the big guys with the big platforms versus someone who's had their privacy violated. I see that right from the very beginning there's an uneven playing field in terms of resources and dollars. What do you see as the initial stages? What I saw with the municipal board was that, if residents had an issue, they could attend the municipal board and not have to engage legal counsel and they could be heard. First the counsel would hear what they had to say, and then the municipal board would hear what their issues were.

    Let's start from stage one. If someone has an issue with Meta, what do they do and what's it going to cost them approximately?

     Thank you very much for the question.

    If somebody has an issue with Meta, the first thing they can do is send a complaint to the Office of the Privacy Commissioner. That costs nothing. You can do it online.

    The Privacy Commissioner can look at that complaint and seek a resolution through alternative dispute mechanisms such as conciliation or mediation. To be clear, those are very flexible mechanisms allowing parties to agree on a resolution that can include damages, for example. It can be resolved right there. In fact, the OPC resolves 70% of the complaints it receives at a very early stage of the process.

    If that's not possible, the Privacy Commissioner can undertake an investigation and has very broad powers with respect to that investigation. It can ask for documents and talk to witnesses—all of the investigative powers it needs to resolve the complaint.

    It can then proceed, because we've given the Privacy Commissioner additional powers in the CPPA. If they want to go forward, they can then start an inquiry. The inquiry allows the OPC to provide some sort of procedural guarantee to parties. They would have to listen to all of the parties involved, but they could conduct those hearings in private. It's not like a court. It's not like a tribunal. Then, at the end of the inquiry, they issue a finding of whether there was a contravention of the act or not. In addition to that finding, they could issue a compliance order asking Meta, in this case—or any other company—to do something or not do something, in order to resolve the solution. It is only if that company decides not to....

    Actually, before I get there, there's also the other avenue for the OPC, which is to enter into a compliance agreement. This is a voluntary agreement. The company would have to agree to enter into that agreement. There are government amendments that allow financial consideration to be part of that agreement as well. This could be a substitute for AMPs, but it could also cover damages. That's another avenue.

    However, if that avenue fails and the company doesn't want to undertake the compliance order or make changes based on the OPC's findings, it can appeal that finding to a tribunal. It's very much an appeal. The OPC, in the first instance, has the power to ask the company to do something or not do something. Only if the company does not agree with that do they have a mechanism to dispute those findings. That's the role the tribunal plays. The OPC can also recommend AMPs in that case, depending on the findings. It is the tribunal that will set those administrative monetary penalties. Typically, in most cases, it will end there, because a decision from a tribunal is final. The tribunal has all the powers of a superior court.

    It's only if there's some allegation that the tribunal did not act within its mandate that you could seek a judicial review from a court, which, in most cases, will not be the case, because the tribunal will be supported by, as I said before, the administrative tribunals support service. This is an organization that supports tribunals in achieving their mandates and therefore ensures some of the independence and procedural safeguards we've talked about. It's really a closed system.

     Really, it will have to go to judicial review in very exceptional cases, where companies think the tribunal has acted outside the powers attributed to it by the legislation.

    Let's take a look at a group of people, at Cambridge Analytica, for example, where a number of people who do not have the resources would not have the financial wherewithal to challenge the actions of a larger group. Throughout all of this process, what would the person who has been offended have to pay?

    Both the Privacy Commissioner and the tribunal don't have formal rules of procedure, so it makes it more accessible and easy. Unless you wanted to engage counsel, you wouldn't have to pay anything to go through that process.

    Part of the discussion that we're having here now is, “let's not have this tribunal”. After the Privacy Commissioner investigates and sets out a fine or a fee and Meta doesn't agree, what happens if we don't have a tribunal?

     Thanks for the question.

     I think that's a very interesting case in point, because it is something that we've contemplated through our own analysis. Our assessment of that scenario is that the case would then be referred to the Federal Court, then onward to the Court of Appeal and then potentially onward to the Supreme Court, depending on the facts of the case.

     Each layer would review the case de novo, which would lengthen the process. What that means is that somebody who was aggrieved or who believed themselves to have suffered a contravention of the act could wait many years for a satisfactory resolution of the case.

    You keep talking about de novo. There are three levels of courts. Is that right? You mentioned that each case is a de novo case. Can you explain what that means?

    The de novo is from the Privacy Commissioner to the Federal Court, which is the case right now.

    What we mean by de novo is that, because the Privacy Commissioner right now does not have any decision-making power—Bill C-27 contemplates that decision-making power—the court doesn't give any deference to the Privacy Commissioner's findings. It has to make its case like anyone else would have to make their case if they took a company or any other individual to court.

     There is no deference provided. That's something that's changing under the process we've contemplated in Bill C-27, where the tribunal would have to provide deference to the commissioner on questions of fact and mixed fact and law. That's what the de novo is. It's really the court substituting its own analysis for the Privacy Commissioner's analysis.

    You mentioned the term “deference”. What does that mean?

     “Deference” means that it's a standard of review. Deference would just be how much you're relying on the commissioner's findings.

     What proposed subsection 103(2) of the CPPA contemplates is that, on questions of fact and on questions of mixed fact and law, the tribunal has to go with what the commissioner said about it, unless there is some compelling reason not to. In most cases, that means that whatever the commissioner found in terms of their findings of fact is final, so the commissioner's findings are a very high bar to overturn, which would not be the case in a court proceeding.

    There is another point I'd like to make as well about the deference piece that's really important to recognize. In a situation where the Privacy Commissioner is faced with a de novo proceeding at a court, the amount of time, resources and effort required on the part of the commissioner to litigate that single case would be absolutely significant.

     Over time, what we expect would happen is that this would start to detract from the ability of the commissioner to have the appropriate resources to dedicate to new investigations, new work, new engagement and new advocacy functions, because more and more of it would get tied up in working through the litigation process. Some of these cases could take several years, depending on how many levels of court the case goes to.

     Not only does it slow down access to justice for the original complainants, not only does it slow down the system in terms of tying up court time, it also ties up the commissioner's time significantly. That means that there are fewer resources available to focus on investigations and the challenges that are appearing out there in the market.

     I understand the process better now after those explanations.

    However, I'm concerned about fairness. We talked about deference and de novo. This is a de novo review or hearing, so if you go into the courts, does that mean that the issues, principles and facts can all be challenged and started all over again? Does that put Joe average person, who's been offended, at a disadvantage, because he has to face a whole new review, a whole new consideration and a whole new offence to be determined?

    That is absolutely correct.

    Okay, so the fairness isn't there in terms of an unequal playing field as far as resources go, if, in fact, we're concerned about the average person who might have a violation by some of these large players.

     Thank you. Those were my questions, Mr. Chair.

    Thank you very much, Mr. Van Bynen.

    Mr. Badawey, you have the floor.

     Thank you, Mr. Chairman.

    Although new on this committee, it was a quick process of learning through the last couple of days with all the materials we've been going through. With that, understanding where we're at right now is simply a comparison between the tribunal and the courts.

    Please correct me if I'm wrong when I pose the question. I'm hearing that the decision by a tribunal is, in fact, final. There is no appeal to the courts.

     Having said that, in the process, there is an opportunity to have mechanisms to ensure that the appellants are able to have their day with respect to some of the things they're trying to accomplish. What I mean by that is that there are mechanisms, such as mediation, before the process unfolds with respect to what the tribunal has to deliberate versus a court. A court would be more like an arbitration, where there are no mechanisms in place to mediate. It's just simply a decision that's made, and that's final.

    With that, we've heard that a court of law is more costly to the appellant. We've heard that it takes more time. It can be a lot more time. It can be years. We've heard that the experience on the issues is more apparent with a tribunal versus a court. We've heard that procedural fairness with respect to a tribunal versus a court, again, is apparent.

    Here is one question I have. In a tribunal versus a court of law, can it actually be dragged on even further, over and above the process, by the defendant in a court of law? Can it be dragged on and on over time, especially if it's AI, and just be in there for years if not decades, based on the wishes of one of the parties?

     As my colleague Ms. Angus pointed out earlier, the rules of procedure would be quite different in the case of a tribunal versus a court. It means it's less likely to be susceptible to being gamed. It's also taking a much narrower perspective on the issue and focusing only on the appeal of the commissioner's decision in a manner that gives deference to the commissioner and the OPC. What that means is that it's looking at a narrower set of issues, which is not procedurally constrained the way a court may be, and it means it's less subject to being gamed.

     I'm having a hard time hearing.

    You're right, Mr. Badawey.

    Colleagues, I hear a lot of chatter around the room. Please keep it down.

    Go ahead, Mr. Chhabra.

    As I was pointing out, because of the differences in rules of procedure and because of the differences in the deference offered, tribunal proceedings would be expected to be much more efficient and quick, not even considering the fact that you'd then have a final decision that could not be further appealed.

    Therefore, there are multiple ways in which this process would be more efficient and speedier in order to reach a conclusion and be more accessible.

     Thank you.

    I am impressing upon the business of government being more efficient and, of course—most importantly—more customer-friendly when appellants have these appeals. Again, it's tribunal versus courts.

    I'm going to jump here now, with respect to the Privacy Commissioner: We heard that the Privacy Commissioner, to some extent, has an ombudsman-type role and advocates. I think what's more important, while they're advocating, is navigating—having those mechanisms available to them while they're trying to navigate based on what they're advocating. Again, in the best interest of the appellant.... I'm hearing that the tribunal versus the courts is more beneficial, especially—and I want to go back to this—with the ability, while you're navigating, to look at the opportunity to mediate and therefore come to some consensus, again, in fairness.

    Some colleagues on the committee have cited the opinions of privacy commissioners about the tribunal, including the Alberta privacy commissioner. In your previous testimony, you mentioned there are key differences between the powers and responsibilities of the federal Office of the Privacy Commissioner under the CPPA compared with provincial commissioners.

    Can you highlight those differences and why they make having a tribunal so important? I really want to emphasize fairness to the appellant at the tribunal level versus the courts.

     Thank you for the question. Again, it's an important one.

    Alberta and British Columbia, to take two examples, don't have the ability to levy administrative monetary penalties. Quebec, in fact, does, but it has an internal model that operates as a tribunal within the CAI. Those are very important differences in the way the processes function. While there may not be the need for a tribunal in some instances, if the desire of Parliament is to put in place a strong regulator with strong enforcement powers, that's what triggers the need to have procedural fairness and impartiality of process baked into the process. It really comes down to a choice about the policy objective Parliament is trying to achieve. If it's to imbue a strong regulator with enforcement powers—one with the ability to levy administrative and monetary penalties up to $10 million, as contemplated in the bill—it needs to have that concordant procedural fairness aspect to it.

    As well, Alberta and British Columbia do not have the ability to enter into compliance agreements, whereas CPPA contemplates a range of tools available to the commissioner to bring cases to ground through mediation, arbitration or negotiation directly with the complainant and the company in question, in order to develop a robust compliance agreement that includes behavioural or process changes as well as penalties—contemplating damages for those who've suffered from the contravention of the act. This is a very powerful set of tools we're putting before the commissioner. Providing that also means providing a clear mechanism for recourse and ensuring impartiality and due process are respected throughout that process.

    That's a good point—impartiality and due process.

    With that said—and I'm going to keep coming back to this—it's about the opportunity to mediate versus arbitrate. That is, in my view, the difference between a tribunal and a court of law. There seems to be some confusion among colleagues on the committee about the development of expertise the tribunal represents. There's a great comparison between, again, the tribunal versus the court of law, in terms of expertise.

    Can you talk about why the tribunal will shorten the learning curve for dealing with privacy cases in Canada on account of the experts required to make up that body? That's point one. Point two is this: Can you delve into the lack of expertise if, in fact, it goes directly to a court of law and, of course, the repercussions because of that?

     There are actually two important ways in which we believe the expertise of the tribunal would function in this instance. The first is that, as we previously pointed out, at least three of the members appointed need to have previous expertise and experience in privacy and information law.

    The second and really critical piece is that, by forming a dedicated body that would hear all of the cases coming through the CPPA, they would quickly develop expertise, understanding and efficiencies in recognizing certain points of fact and common patterns or issues that are emerging across a number of different domains. In that way, they would be much better equipped to assess and respond to the commissioner's findings and recommendations as compared to a general court, which would not have, at its base, expert members who are focused in privacy and information law and would not necessarily be seeing multiple cases in the same domain. It would, therefore, not be able to develop over time that degree of expertise, familiarity and comfort with the issues.

    This becomes particularly important in a domain like privacy and information where we're, for the most part, talking about highly technical issues that change rapidly based on the changing technology and the changing utilization of data. Again, it reinforces the importance of having expertise and a degree of focus and dedication on the issue.

     I'm really relying on, as you mentioned earlier, the policy objectives. What comes directly to front of mind is fairness. With that said, the range of tools, the enforcement powers and strong powers that a tribunal would have to offer the process with respect to fairness and meeting those outcomes are less cost, less time for the appellant and the inability of the other side to drag on over time based on its interests, which we often see in the court of law.

    Again, I want to go back to what I said earlier about advocating and, more importantly, navigating in terms of what your objectives are with respect to your advocating. With regard to compliance agreements' being negotiated, hopefully most times they'll be through mediation versus having them go the full field. That's appealing to me.

    From my municipal experience as a former mayor for 14 years, I have great experience in witnessing a lot of tribunals in action, whether through the Planning Act vis-à-vis through the Drainage Act, with courts of revision and tribunals, and when we look at the tenant board provincially and at its adjudication process. The list goes on. Again, I'll go back to that word, “fairness”. How did it actually provide that navigation, with respect to the objectives, based on the advocation of fairness?

     When we look at the alternative dispute mechanisms that are available in comparison to a court of law, we see once again that they really offer that ability for a fairer process for the appellant. Lord knows, in some of the cases, considering who they're up against, they're going to need that fairness because—let's face it—sometimes it's a David-and-Goliath situation. We're already seeing that in some cases, especially with what we're discussing today.

    Therefore, with respect to that comment, I think that we all agree that there needs to be a system to review decisions made by the Privacy Commissioner. However, there may be some hesitation around the table with regard to why it has to be in the form of a tribunal versus a court, so I want to go back to that.

    I believe that the intention was to support Canadians and small businesses without extensive legal resources, costs, time and everything I've mentioned already. Is that so? With that, what are some of the other ideas or thoughts that can be added to this conversation?

     I think it's an important issue to unpack a little bit. Part of the rationale here is to understand that having an expert tribunal focused on the issues and dedicated to this work does offer many benefits to the administration of justice and to ensuring that the law is effectively and consistently applied. It also makes sure that the commissioner and the OPC are central in both the fact-finding and the investigation. The role of the OPC becomes strengthened by having an expert tribunal available to hear the appeals.

     In a situation where a tribunal gives deference to the Privacy Commissioner, that is a much more robust and powerful hand for the Privacy Commissioner to play, even if the case does not go to the tribunal at the end of the day. What I mean by that is that it actually motivates parties to work with the commissioner to resolve their cases because they recognize that, if they choose to take it to the tribunal, they would be doing so on the basis of playing a weaker hand in front of that tribunal because of the deference the tribunal must show to the commissioner.

     That is not the case with the courts, and we've seen that over the last 20 years. A number of cases have gone to the courts, and the Privacy Commissioner has lost 70% of the cases in which he or she was a primary appellant. Seventy per cent of the time the Privacy Commissioner's findings or administrative monetary penalty recommendations have been overturned.

    Again.... I guess this is somewhat becoming the narrative of my questioning: the fairness. That's the bottom line, in my view, in my opinion: fairness. Less cost, less time, the possibility for mediation.... When we look at that compared to the courts, with more cost, more time and, to some extent, depending on who the Goliath may be, a lot more time, possibly decades, are we actually meeting our objective? Are we then actually meeting the outcomes that we would otherwise expect to come out of the process?

    Finally, is there the ability for it to then lend itself to other issues that may arise within the same sector, the same realm, if you know what I mean? I guess I can pose this in the form of a question. Would, then, a decision made by a tribunal be considered part of case law in terms of other situations that might arise so that it can then lend itself to expediting or mediating other issues that might come to the Privacy Commissioner and/or possibly the tribunal and/or a court of law?

     Thanks for the question. It's a good one.

    It would form the corpus of decisions that would inform the OPC, and it would inform the interpretation and application of the CPPA. Within the internal world of the consumer privacy protection act, each decision of the tribunal would have an effect of setting a precedent in work within the CPPA. It would not affect the broader court system, but it would really be functional for the CPPA, which is, I think, what is intended.

    The outcome here that we want to come to is with respect to privacy. We can see what's out there right now, and we can see the effects on people of what's out there right now. The second narrative that I'm leaning now towards is people. It's about the effects on people, and it's about having fairness to deal with some of the effects on people. If that's the outcome that we're all looking for—which I would expect it would be as members of Parliament, regardless of what party we may belong to—the outcome is to ensure that these are dealt with in a timely and fair manner.

    In your opinion, as the people who know a heck of a lot more than we do in this realm, what is the bottom line in terms of meeting those outcomes between a tribunal and a court of law?

    I have all the testimony if you want to see it.

    Voices: Oh, oh!

     Our testimony over the last several meetings has been very clear, but I'm happy to recap.

    We see there being significant efficiency gains by implementing a tribunal. It's absolutely and fundamentally important, in order to maintain alignment with the Constitution, to have procedural fairness and due process built into the system. Doing so via a tribunal is the most efficient and effective way to do so. We've thought very carefully about how to make sure that it does not become an additional layer of review, for example, by ensuring that the tribunal gives deference to the commissioner's findings and decisions and by ensuring that it's a final level of review and not subject to appeal.

    There are many ways in which this has been designed carefully to ensure that the important objectives of procedural fairness, efficiency, effectiveness and access to justice are appropriately centred, and to ensure that, in so doing, the role of the Privacy Commissioner remains primary and cannot be subverted by a large corporation that's able to drag out court proceedings and drain the Privacy Commissioner of the resources and time needed to effectively steward consumer and Canadians' privacy through the markets.

    Thank you. I appreciate that.

    I only had to hear it once. I appreciate your repeating it, so some of the members can hear it a few more times. Hopefully, that will make a difference, because, again, I want to go back to what I said earlier.

    It's the outcome that we're actually trying to accomplish here. It goes back to dealing with fairness, and fairness to people who, to some extent, for the most part, are very hurt by the situations they're finding themselves in, especially some of the youngsters experiencing some of these situations who would otherwise find themselves in a tribunal and/or a court of law.

    I have one last question. When discussing tribunals, we've referenced other international jurisdictions. I know I've heard this already—you referred to it—but, again, I do want to be repetitive, and I do not apologize for that because some do need to hear it maybe more than once.

    When discussing tribunals, we've referenced other international jurisdictions that do not have.... I'm sorry. They do have privacy tribunals. We've talked a lot about comparisons with the Competition Bureau, but are there other examples, throughout governments, possibly? How are those models used to inform this tribunal, and what benefits have we seen with tribunals in other areas of federal regulation?

    We've discussed several international examples, but also domestic and other federal examples where tribunals are used.

    I'll start with domestic. The CAI, which is the privacy regulator in Quebec, is an administrative tribunal. It operates extremely efficiently and is able to reach the outcomes that you outlined.

    Within the federal system, there are many examples of tribunals. We have the CRTC, the Canadian Radio-television and Telecommunications Commission, which is responsible for administering the Broadcasting Act and Telecommunications Act. We have Canada's anti-spam legislation. These are not trivial issues. These are administrative tribunals that are very highly respected.

    I spoke earlier about the administrative tribunals support service that provides administrative services to tribunals. It supports 12 federal tribunals, including the Competition Tribunal and the Social Security Tribunal. We've seen that it cuts time in terms of access to justice and getting to the outcomes as quickly as possible. Right now, the OPC faces a two-year delay in getting to court. In the Social Security Tribunal, it's less than 100 days.

     There are significant benefits in terms of getting to the outcomes faster and in a cheaper way, because tribunals, typically, don't have the same formal rules as a court. Parties do not need to retain legal counsel. The more formal and procedural a setting is, the more need for legal counsel, so a tribunal really allows parties to access justice in a way that's cheaper and faster.

     Again, I would underline those words: fairness and people. With respect to accessing justice and to be fair to the people, not everyone can afford the process of a court, especially if they're against a Goliath, and especially if that ends up in the court for decades against that Goliath. We can be talking hundreds of thousands of dollars, if not millions, for a person who just doesn't have it. Therefore, there is no fairness for the people.

    There is more cost based on more time, versus a tribunal, which offers that fairness and offers, based on the cost, less time and, therefore, less cost. Is that fair to say?

     I think that's fair. I think it also offers an additional feature that we've referenced a few times. It centres the role of the Privacy Commissioner. It gives the Privacy Commissioner more authority, more weight.

    As I pointed out earlier, if a company knows that they can go and get a fresh start with a court and impugn the commissioner's approach or the impartiality with which it was conducted, that certainly creates a challenge, whereas the tribunal has to give deference to the commissioner's findings. That makes the commissioner far more powerful.

    Mr. Chairman, I'll end by saying this. Again, being new to the committee and taking all of this in within the last few days, I want to thank you. I want to thank the committee, quite frankly, and I want to thank all the witnesses.

    The take that I walk away with, based on what I'm seeing and what I'm hearing, is based on those two points—fairness for the people. I think the tribunal does meet the outcome we're trying to achieve here as well as the expectations we're trying to meet on behalf of the people we represent.

    Thank you.

     Thank you, MP Badawey.

    I'll now turn it over to Mr. Perkins.

     Thank you, Mr. Chair.

    The comments about the CRTC being comparable, to me, are erroneous, because there is no body making a decision before that which then gets appealed to the CRTC. It's a single-issue commission making a decision. It's actually more relative to what we're proposing than what officials are proposing, but what's interesting.... I'm not surprised that the officials who drafted the bill are defending the bill.

    For the two new members on the committee who, perhaps, didn't attend the 21 meetings with witnesses and the 10 meetings here.... We've now had six meetings over two clauses in which the Liberals have filled the air with two clauses.

     I'll take my guidance from the current and former privacy commissioners on this issue. To help you, because you haven't heard the testimony, I'll read what they said. There was a bill that was essentially identical to this with regard to privacy and the tribunal in the last Parliament, called Bill C-11. The then-privacy commissioner, in his submission, said:

    That was about the last bill. To refresh your memory, this is what the Privacy Commissioner said in his testimony on this bill in meeting 90 on October 19, 2023:

    Unlike MP Badawey, who thinks it would make it shorter, the Privacy Commissioner thinks it would make it longer and, by the way, more expensive. If you care about fairness and you care about the people, and you want it to be less expensive and quicker, I would rely on the Privacy Commissioner's testimony for fairness and people. He says this process will actually make it longer and more expensive.

    Now, not to be outdone, I'll give you a little more from meeting 91, when the former privacy commissioner said:

    We have an issue here with the government continuing to put the proposition out that, somehow, creating a privacy tribunal will speed it up, when that's not actually what the experts say. I would rely on the privacy commissioners.

    I would also say that in the case of the Competition Tribunal, which is probably the most comparable to this, you have a Competition Bureau, which does an investigation, and a Competition Tribunal, which doesn't have to follow evidentiary rules and only has two minor things that you can appeal. It's almost, but not quite, a final decision-making process. It actually makes for a very long and very expensive process, and it has actually never rejected anything that's been done in a merger.

     I'm just trying to help our new members understand that, if they believe this makes it faster, the testimony we heard from privacy commissioners, both provincial and federal, over 21 meetings of witnesses, says the opposite. That's all I wanted to say.

    I understand that was not a question, but a comment. Thank you, Mr. Perkins.

    I have MP Arya.

     Thank you, Mr. Chair.

     I have a question for Mr. Chhabra.

    You rightly pointed out that the presence of a tribunal, or the availability of the process of using a tribunal, motivates the parties to seek some sort of agreeable outcome at the commissioner's level. That is very important, especially given the background.

     Before I go to that, you mentioned the behavioural process change. Was this what you were referring to when you mentioned that?

     Thank you for the question. It's a very important point to raise.

    The tribunal has to give deference. Therefore, this notion that, somehow, companies would be motivated to go to the tribunal more so than they'd be motivated to go to a court—if you were to substitute a general court instead of the tribunal—doesn't hold up under scrutiny. The notion that a company would be more motivated to go to a tribunal they know is going to give deference to the commissioner's findings of fact just doesn't hold up.

    Especially with the fact that, in 70% of cases on Privacy Commissioner rulings challenged in the court, the Privacy Commissioner lost.... This is a unique feature that I don't think other countries have. Most G7 countries don't have a tribunal. With the changing circumstances, I think Canada has to take the lead.

    Am I correct on that comparison regarding other G7 countries?

     As we've pointed out throughout our testimony over the last several days, there are a number of other G7 countries that have tribunals or tribunal-like approaches that help separate the investigatory and adjudicative functions. There's Australia, New Zealand, Singapore and the U.K., with a slightly different wrinkle. Ireland is very comparable as well.

    The notion of separating investigation and adjudication is a bedrock principle of functioning democracies.

     The U.S. has the Federal Trade Commission. It's one big, huge bureaucracy. They don't have a tribunal, but they have a very complex process of handling these things.

    Is that correct?

    The Federal Trade Commission doesn't operate in the space of privacy and data protection. It's also a commission by design, which means it's not a single individual taking a decision. Procedural fairness considerations there are baked into the fact that it's a commission or a group of people taking decisions.

    You mentioned expertise and how the members appointed to the tribunal will not only have a good background and expertise in this knowledge but can also continue to upgrade their knowledge in this. They can become much more specialized.

    I remember when I was debating this bill in the Parliament. A question was asked. I explained that technologies are changing so much that we can't even define what data is. What are the contours of data? We can't even define what artificial intelligence is. When it comes to privacy, based on all these things, it will become very difficult for the courts to decide. The courts have to limit themselves to the law. Whoever decides—like a judge—cannot get that expertise or additional knowledge required with the changing circumstances and changing technologies.

    What kind of workload do you expect, when the tribunal is formed, in the first two years?

     Thanks for the question.

    As we noted earlier, it's somewhat difficult to give a point estimate or even a range estimate, frankly, on how much activity such a tribunal would see. There are a number of factors to consider. The commissioner would have significant new powers but also significant new opportunities to navigate through an individual case by taking a mediation approach or a compliance agreement approach. If the commissioner, for example, were to work through a case and find that making orders was sufficient, the case wouldn't necessarily need to go to the tribunal at all. It's difficult to give an estimate of exactly how many cases would be taken up.

    We can look back and say, from memory, that there were about 46 cases between 2003 and 2024 that went to court on the basis of the Privacy Commissioner's finding, but that's a different set of circumstances, one where the commissioner does not have the ability to levy or recommend administrative monetary penalties or have order-making powers. We are talking about a completely new approach to providing the commissioner with significant enforcement powers. How much activity that would generate for the tribunal is difficult to say, but we are very confident in presenting the committee with the idea that it would be more efficient to have a tribunal in place, which would be more rapid and expert in its work.

     In general, do you think we will see an increase compared with the previous number of things that went to court?

    Given the new powers being vested with the commissioner and the increasing ubiquitousness of important data and privacy issues among Canadians—including because of the rising use of AI tools—I think it would be reasonable to assume that there would be more activity going forward. There may well be more demand for either a court or a tribunal to be engaged on those decisions.

     As you said, there's a possibility of more workload.

     It does make the Privacy Commissioner's work efficient. Without the tribunal, all these cases will go to the courts. With the time required to get them dealt with, the resources required will be quite substantial.

     Thank you again for the question.

    I think this is a really important issue to underline, noting that some previous witnesses have highlighted that they feel like the tribunal could add process and time. It's not entirely clear to me whether all the witnesses had the opportunity to be fully briefed on the functioning of the proposed bill on the idea of two elements in particular: first, that the tribunal would be required to provide deference to the commissioner's findings and, second, that the decisions could not be appealed. Those two pieces in concert provide a significant backstop against abuse of process, against processes being unduly extended and against multiple levels of appeal. As I pointed out earlier, it really centres and puts the spotlight on the Privacy Commissioner.

     I cannot imagine a scenario in which any company with a reasonable amount of legal advice would rather go to a tribunal that has to pay deference to the commissioner versus this other approach, which apparently is going to a court and starting de novo. Any lawyer worth their salt advising a company would say they'd rather take their chances starting fresh at court and see if they can convince the court to see it differently versus, “You've got a tribunal in place that's going to pay deference to the commissioner's findings? Boy, your chances are a lot lower in that circumstance.”

     On this notion that has come up a few times in the committee that somehow the tribunal slows things down and companies will be more motivated to go to the tribunal and less motivated to work with the Privacy Commissioner, I would have to say that represents a significant misunderstanding of the functioning of the bill.

    I agree with you on that point.

    Have you looked at any scenarios for how many of the ones that are dealt with at the tribunal level will go to court?

     As we mentioned earlier, we looked at roughly the last 20 years of cases that have gone to court. About 46 decisions, I think it was, from the commissioner have been taken to court. In a minority of those, the commissioner was actually a primary appellant. In those cases, the commissioner lost 70% of the time before the courts. That, I think, gives a very clear demonstration of why companies might be motivated to go to court. They have a pretty good chance of winning.

     Again, it's a pretty stark contrast between going to a court and doing a de novo proceeding, where the history has shown that courts tend to side with the companies, versus a tribunal that has to give deference to the commissioner. That changes the playing field entirely.

     Can you give any examples of any of the court cases that have gone previously to the court and took quite a long time to get settled?

     I can talk about a very recent case. A few years ago, actually, the OPC made a finding with respect to Meta and the Cambridge Analytica scandal. The commissioner issued its report of findings a few years ago. Meta disagreed with those findings and took the OPC to court on those. The OPC lost at Federal Court. The Federal Court actually sided with Meta to say that the OPC had not discharged its investigative burden and had not presented its evidence.

     Now, I'll just make a connection here to what my colleague said. Again, because they're not showing any deference to the Privacy Commissioner, it's a de novo proceeding. This would not be the case with a tribunal, which would have to accept the commissioner's finding of fact unless there were a palpable error.

     That decision was appealed by the Privacy Commissioner last summer. We're still waiting for a decision from the Federal Court of Appeal. I think we can assume that the decision would be appealed to the Supreme Court as well, because of the parties involved. It's going to take years to get to a final resolution.

     Again, that would not be the case in this new system, where a tribunal's decisions are final and can only be judicially reviewed, which is a much narrower standard of review and which means it's much more difficult to make the case. The parties would know that and again, to echo my colleague's comments, would therefore perhaps be more motivated to pursue alternative dispute resolution mechanisms or compliance agreements.

     Obviously, you're right. In the Meta-Cambridge Analytica case, they have the muscle power to take it all to the Supreme Court, so the time will be taken there.

    If the same case were with the tribunal, would the chances of its getting resolved be much better, do you think, than the current one?

     In fact, that is the design of the system that's proposed by Bill C-27 in the CPPA. It is, in fact, to have the commissioner have a stronger hand at that appeal process by virtue of the fact that the tribunal has to defer to the commissioner's findings of fact and the mix of the findings of fact and law.

     That is an entirely different playing field from what you'd find at court. In that way, it is very much designed to ensure speed, as well as to provide the commissioner with a significantly stronger hand than if he or she were to take a case to court. Also, of course, the fact that the finding itself of the tribunal can't be appealed is another piece that creates a very significant backstop against a lengthy delay or overextended process.

     Recently, I was reading or listening to something about the empires in the history of the world. In recent history, we have the British Empire. We almost have an American empire. However, the future empires will be dominated and controlled by the technology companies, which have the strong muscle power and the cash power. Dealing with them requires new tools. We have seen Meta, which is the very prime example.

     When dealing with those companies, the tribunals—with the experts on the benches of the tribunals—play a very important role.

    Mr. Chair, how much time do I have?

     Mr. Arya, we're out of time.

     This brings our meeting to an end, but before we adjourn, I just want to thank Ms. Angus and Mr. Chhabra for joining us yet again.

    You've been with us for the whole month of May, and this is technically our last meeting on Bill C-27 for some time. We're at CPC-9.

     I hope that this summer will make us reflect on where we want to go with this bill. Thank you very much for your professionalism and for your time.

    I would also like to thank Mr. Mark Schaan, who is not here today.

    The meeting is adjourned.