Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, or the Digital Charter Implementation Act, has been introduced by the federal government with the promise that it would enhance privacy protections, adequately regulate AI and protect human rights. The bill, however, is not up to the task.

We have recently published a joint open letter with 45 leading civil society organisations, experts and academics outlining key concerns with the bill.

We have also sent a brief to the House of Commons Standing Committee on Industry and Technology for their current study of Bill C-27. Our submission covers the following areas and general recommendations:

1. 1. The Consumer Privacy Protection Act (CPPA)
      1. Recognizing privacy as a human right
      2. National security-related exemptions to consent must be removed
   2. The Personal Information and Data Tribunal Act (PIDTA)
   3. The Artificial Intelligence and Data Act (AIDA)
      1. Over-arching concerns
      2. Expanding scope of coverage of AIDA
      3. Definition of harms must be extended to include group-based harms
      4. Exclusion of national security related technology must be rescinded
      5. Need for independent oversight and review

Given that our expertise is on the impact of anti-terrorism and national security on human rights and not specifically on consumer privacy protection, there are areas of this bill that we have not commented on. We would emphasize, though, that our silence on certain sections does not signal support, given that we are aware that there are several other aspects of this bill that privacy, consumer rights, human rights and civil liberties organizations are raising concerns over.

In line with our mandate, however, we have shared serious specific concerns regarding national security related exemptions:

1. We are deeply concerned that Bill C-27 maintains overly-broad exceptions to consent when it comes to the collection, retention, use and disclosure of personal information for national security reasons. We believe that these provisions (s. 47 and 48) must be removed from C-27. If they remain, though, such activities should only be possible, by law, if there are “reasonable grounds to believe that the information relates to an imminent threat to national security, the defence of Canada or the conduct of international affairs.”

2. Despite the exponential growth in interest for the use of artificial intelligence tools by governments for counterterrorism and national security purposes as well as their serious risks to human rights, Bill C-27 shockingly excludes the application of the Artificial Intelligence and Data Act to:
   “…a product, service or activity that is under the direction or control of
   (a) the Minister of National Defence;
   (b) the Director of the Canadian Security Intelligence Service;
   (c) the Chief of the Communications Security Establishment; or
   (d) any other person who is responsible for a federal or provincial department or agency and who is prescribed by regulation.”

   This exclusion of national security related technology must be rescinded.

Read our full brief for more details on each section, our recommendations and specific legislative language for amendments.