Making Life More Affordable for Canadians Bill

Therefore, honourable senators, in amendment, I move:

That Bill C-4 be not now read a third time, but that it be amended, in clause 47, on page 23,

(a) by replacing line 5 with the following:

“446.6 (1) The policy for the protection of personal informa-”;

(b) by replacing line 18 with the following:

“or through the use of cookies;”;

(c) by replacing line 22 with the following:

“personal information that is under its control;

(f) require the party to protect the personal information that is under its control through physical, organizational and technological security safeguards with a level of protection proportionate to the sensitivity of the personal information;

(g) require the party to take appropriate steps in the case of the loss of, unauthorized access to or unauthorized disclosure of personal information that is under its control as a result of a breach of its security safeguards, including by, as soon as feasible, informing the individual whose personal information has been lost, accessed or disclosed if it is reasonable in the circumstances to believe the breach creates a real risk of significant harm to the individual;

(h) require the party to ensure, by contract or otherwise, that any person or entity to which it transfers personal information provides a level of protection of the personal information equivalent to that which the party is required to provide under the policy;

(i) require the privacy officer or their delegate to attend, at least once per calendar year, a meeting held by the Chief Electoral Officer on the protection of personal information; and

(j) prohibit the party, as well as any person or entity acting on the party’s behalf, including the party’s candidates, electoral district associations, officers, agents, employees, volunteers and representatives, from

(i) providing false or misleading information to individuals about the purposes for which the party collects personal information,

(ii) selling personal information under the party’s control, or

(iii) disclosing personal information under the party’s control to the public for the purpose of causing harm.

(2) For the purposes of paragraph (1)(g), the factors that are relevant to determining whether a breach of security safeguards creates a real risk of significant harm to an individual include

(a) the sensitivity of the personal information involved in the breach; and

(b) the probability that the personal information has been, is being or will be misused.

(3) For the purposes of this section, significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.”.

I realize — and I do apologize for reading that so quickly — this seems long, but you have to understand this is the precise language of Bill C-65. All we would be doing is importing this language back into the bill where it should be, and the government signals that by taking the first clauses of this section and using them in Bill C-4. It’s as if they just forgot the second page.

Is this a perfect solution? No, but unlike a sunset clause, which is ill-equipped to deal with things such as the fact that the bill is retroactive to 2000, unlike a sunset clause, which will, when it expires, leave us with a worse condition than we have now, this allows us to create a basic standard of privacy that the government itself set out in Bill C-65 not so many months ago. It is not a perfect solution, but it is at least an attempt to put leashes on the foxes and muzzles on the goats.

I have almost three minutes left for questions.