November 13, 2024
The Empire Club of Canada Presents
Shaping Ontario’s Digital Future | Hon. Todd McCarthy
Chairperson: Jenna Donelson, President, Board of Directors, Empire Club of Canada
Moderator
Jenna Donelson, Chair of the Board of Directors, Empire Club of Canada
Distinguished Guest Speaker
The Honourable Todd McCarthy, Minister of Public and Business Service Delivery and Procurement, Government of Ontario
Head Table Guests
Coral Kennett, Head of Provincial Government & Education Canada, Amazon Web Services
Jeanette Patel, Director of Government Affairs & Public Policy, Google Canada
Welcome Address by Jenna Donelson, President, Board of Directors, Empire Club of Canada
Good afternoon, everyone. Welcome to the Empire Club of Canada. My name is Jenna Donelson, and I am the chair of this historic organization, and your host for today’s event.
To formally begin, I want to acknowledge that we are gathering on the Traditional and Treaty Lands of the Mississaugas of the Credit, and the homelands of the Anishinaabe, the Haudenosaunee, and the Wendat Peoples. I encourage you all to learn more about the Traditional Territory on which you work and live.
I’d also like to begin by recognizing our sponsors. The Empire Club is a non-profit organization, and our sponsors generously support the club. They make these events possible, and they make online complimentary for our viewers. So, thank you. Thank you to our Lead Event Sponsors, Amazon Web Services, and Google. And thank you, as well, to our VIP Reception Sponsors, the Insurance Bureau of Canada, and the Ontario Real Estate Association. Thank you, as well, to our Supporting Sponsor, Kyndryl. And thank you to our Lead Season Sponsors, Bruce Power and Hydro One, and our VIP Reception Season Sponsor, Waste Connections of Canada. And finally, thank you to our Media Partner, the Toronto Star, and our AV Partner, Bespoke Audio Visual.
If you have a question for the minister, please scan the QR code that is found on your program, or through the Q&A function, if you are online. For those of you online, if you need technical assistance, use the chat function, and our team will be there to help.
I’d like to begin by considering how today’s conversation addresses the challenges of the present, while ensuring we are ready for the future—a future that is not entirely known. Many of us may find ourselves a bit nostalgic about a slower, much quieter world, when it comes to technology. But when we consider the technology of even a decade or two ago, it’s pretty unimaginable today. The vast unseen network of information, and data, and ideas, and social connection, that we carry around in our pockets, and use many, many, many times a day, is more than just supportive technology. It’s become as essential as electricity, or frankly, air or water, when it comes to productivity and survival, in our modern digital world. Lose your phone, and you don’t just lose a device; you lose agency, you lose the ability to get around—for some of us, you may just lose your identity. And in a lot of ways, I think we’ve become the sum of our data.
And criminals and bad actors know this—and in fact, they are banking on it. A recent report from the Canadian Centre for Cybersecurity tells us that cybercrime is a persistent, widespread, and disruptive threat that is facing each of us. Not to mention our children, our schools, and hospitals, and even our governments across Canada. Some criminals are now specializing in cybercrime as a service, picking your digital pocket as easily as someone in a crowded street may lift your wallet. And state-sponsored actors have grown more aggressive, and are using our connectivity to influence public opinion, and in some cases, even attempt to undermine democracy. So, this is not a partisan issue. This is, quite simply, a personal and public safety issue, and a security issue. It’s complex, consequential terrain. And we, at the Empire Club, think it is important to host this conversation.
Here in Ontario, the proposed Strengthening Cybersecurity and Building Trust in the Public Sector Act reflects a commitment by the government to address these and other issues head on. The legislation is designed to create a framework to protect Ontarians’ data, particularly, some of the most vulnerable members of our society. It also intends to modernize our privacy protections, and improve our cyber defences, in the face of evolving risks, not to mention create the condition for government to harness the power of AI technology confidently and responsibly. There’s a lot in there, Minister. And you are all here today because you have a stake in this. Whether you’re a policymaker, an industry leader, or just a concerned citizen, you’re here to better understand this moment, and the threats we face, as well as the opportunities that we risk losing, if we don’t get this right. And for this important conversation, I’m so happy to have our Minister of Public and Business Service Delivery and Procurement, the Honourable Todd McCarthy, here with us today.
This is going to be a substantive conversation, and I look forward to diving in. And to introduce the minister, it is my pleasure to welcome Coral Kennett, Head of Provincial Government and Education Canada, from Amazon Web Services and one of our Lead Sponsors for today. Welcome, Coral.
Opening Remarks by Coral Kennett, Head of Provincial Government & Education Canada, Amazon Web Services
Good afternoon, everyone. I’m Coral Kennett. I’m the Head of Provincial Government and Education for AWS, in Canada. AWS is pleased to sponsor today’s luncheon. And I’m honoured to be here, to introduce our distinguished speaker, the Ontario Minister of Public Service and Business Delivery, and Minister Responsible for Supply Ontario, the Honourable Todd McCarthy. We look forward to the minister’s remarks today. And I know he will speak more about his priorities around shaping Ontario’s digital future, strengthening cybersecurity, and building trust in the public sector, including legislation he introduced earlier this year.
AWS is the world’s largest and most broadly-adopted cloud provider. And much like the Ontario government, AWS is focused on supporting and fostering innovation, throughout the public sector. Millions of customers, including startups, small and medium enterprise, and leading government agencies, are using AWS to innovate faster, and become more agile. And at AWS, we are very committed to Canada, and to the province of Ontario. AWS is planning to invest an estimated $24.8 billion throughout the country, by 2037, in new and expanded infrastructure regions, or data centres. And Toronto is home to one of our major technology hubs, where we employ over 3,500 people in highly-skilled roles, from software engineers to data scientists. It’s these individuals that are constantly innovating, and contributing to the technology ecosystem, right here in Ontario.
And across our wider Amazon family, we employ more than 25,000 people, throughout Ontario. And next year, we plan to launch our first AWS Local Zone, here in Toronto. Local Zones are a type of infrastructure, that bring cloud services closer to where the customers need them. Meaning more startups, entrepreneurs, as well as government, will be able to leverage the latest in cloud technologies. And we think it’s important to contribute back to the communities where we operate. That’s why Ontario was one of the first jurisdictions in Canada, where we launched our AWS Restart Program, which is an initiative tailored towards helping train unemployed and underemployed individuals, to get critical cloud technology skills, so they can get their first job in the tech sector.
In today’s increasingly digital age, cloud is the vehicle that powers AI at scale and helps public sector transform the ways in which they serve their citizens. And throughout AWS, public sector organizations are already revolutionizing their operations, from hosting secure, scalable websites, like ontario.ca, which provides 24/7 access to vital information and services, enabling health departments to better plan hospital capacity, and ensure that resources are allocated more efficiently, and in our ongoing battle against natural disasters, departments and agencies are leveraging AWS to support wildfire management, using data analytics and machine learning, to respond to threats more efficiently. These innovations aren’t just improving government operations; they’re helping to save lives, and protect communities.
But we know there is still a lot of work to be done. Cyber attacks and instances, notably against public sector organizations and critical infrastructure, have seen a dramatic rise in recent years. The impact of these attacks can be devastating and costly, making it increasingly important to be cyber-ready. And that’s, why earlier this year, AWS launched our new provincial and municipal Cybersecurity Grant Program. This is a $10 million investment in Canada, to help government and education institutions improve their security posture, and advance their ransomware protection. With its extended support, AWS reaffirms our strong dedication to supporting provincial and municipal governments, at every stage in their cybersecurity journey.
It’s an exciting time for AWS to be partnering alongside public sector. We’re proud to play a key role in helping to build protective and innovative services for a modern Ontario public sector and economy. And on that note, I’d like to turn it over to our guest speaker. So, would you please give a warm welcome to Minister Todd McCarthy.
The Honourable Todd McCarthy, Minister of Public and Business Service Delivery and Procurement, Government of Ontario
Good afternoon, everyone. And thank you, Coral, for that very kind introduction, and setting the stage for today’s important conversation. And to the entire Empire Club team, thank you for welcoming us, here today. Jenna Donelson,, thank you for your incredible leadership here, as the chair of the board of the Empire Club. I look forward to our fireside chat, following today’s speech. I also wish to thank my colleague and great friend, Parliamentary Assistant and MPP for Cambridge, Mr. Brian Riddell. Please join me. Thank you for being here, and for all that you do, day in and day out, to support our ministry’s work for the people of Ontario.
I’m here today to lay out our plans and our vision for shaping Ontario’s digital future. And make no mistake about it, the future is bright. But it will take constant vigilance to make it so. Now, more than ever, our loved ones’ daily lives, especially our children, and indeed, our economy, and our security, are increasingly intertwined with today’s ever-evolving digital world. Future-proofing our digital infrastructure, and enacting the proper safeguards to reap the rewards of this digital revolution, while mitigating risks, will determine the success, the security, and the economic prosperity of Ontario for decades to come. Today, we stand at a critical juncture, a critical juncture in Ontario’s journey toward a secure, resilient, and forward-looking digital future. In this constantly advancing digital world, our shared mission to protect Ontario’s digital landscape is more urgent than ever.
And I’m proud to share with you, then, how we plan to do so, through Bill 194, the Strengthening Cybersecurity and Building Trust in the Public Sector Act, 2024. This landmark legislation is not just a necessary response to the challenges we face, but it is a strategic, proactive approach, to protect our public services, our institutions, and the well-being of every Ontario citizen and resident. Our commitment to cybersecurity can never be overstated. The digital era has opened new frontiers of opportunity, of convenience, and of connectivity.
Yet, as we embrace these advancements, the risks we face grow more sophisticated, and more aggressive, each day. Ontario’s essential public services, our healthcare, our education, child welfare, and more, are all potential targets for cyber criminals, whose motives range from financial gain to deliberate disruption of our systems. Bill 194, then, represents Ontario’s promise to address these threats with the strength, the foresight, and the adaptability required to protect our society’s most critical functions. To protect all Ontarians with the protection of our children, and the most vulnerable in our province, at the forefront of all of our efforts, this legislation underscores our determination to create a safe, secure, and trusted public sector in Ontario. With this act, we are not only enhancing the resilience of our systems, but we are also setting a high standard of vigilance and preparedness. The aim is clear: to continue positioning Ontario as a national leader in cybersecurity—and yes, we are leaders, and we will continue to be so. This bill, if passed, would implement standards, tools, and protocols to prevent, detect, and rapidly respond to cyber threats. By reinforcing these defences, we are taking necessary steps to counter threats from cyber criminals that could compromise the safety, the privacy, and the prosperity of our people.
The urgency behind this legislation is clear. In recent years, we have witnessed cyber attacks targeting hospitals, schools, and financial institutions, globally. Denial of service attacks, ransomware, phishing, and cyber espionage, are all threatening our national security, our well-being, and the health of our economy. In October, 2023, cyber criminals encrypted Toronto Public Library computer systems, and stole employee data, essentially, shutting down services for months. That same month, a ransomware attack took critical systems at five Southwestern Ontario hospitals offline for weeks. And the recovery was a cost of upward of $7.5 million. A similar attack hit the Toronto Zoo, in January of this year. And in the City of Hamilton, we’ve seen the expenditure of millions of dollars to rebuild the IT network, after a February 2024 ransomware assault. Now, according to IBM’s latest annual cost of a data breach report, cyber breaches cost Canadian organizations, on average, $6.32 million per incident, in 2024.
Now, these are just a few examples of the cyber threats that our province and our nation are facing, every single day. And these criminals are only getting more sophisticated, and more sinister. What is clear is that the number and severity of attacks will only increase. Government simply cannot afford to be passive. We must be proactive, we must stay ahead of the criminals, who wish to harm our residents, our government services, our economy, our way of life, and the well-being of our great province. It is our duty as government to protect our citizens and residents, and we do need to act now. The cost of these incidents is not only financial, but deeply personal. They impact the future, our security, and our livelihoods.
That is why, on May 13, 2024, I was honoured to introduce, in the Ontario 43rd Parliament, this proposed landmark legislation, Bill 194. If passed, the bill would set the foundation to establish requirements for public sector organizations to strengthen cybersecurity, enhance privacy safeguards, and ensure the responsible use of artificial intelligence. In October, I was pleased to see the completion of second reading debate on Bill 194, and its approval for consideration by the Standing Committee on Justice Policy—and in fact, I’ll be addressing the committee on Thursday morning at 10 a.m., to lead off consideration of the bill at that committee. The debate in the legislature confirmed just how vital this legislation is to the people of Ontario, as well as the public and broader public sector that serves the people. We can and we must foster growth in our digital economy, while at the same time, safeguarding our citizens, and their data, and their privacy.
Bill 194 was developed in consultation with experts, academia, and key public sector stakeholders. And we are continuing to engage with stakeholders and experts, to ensure that any regulations or directives arising from this bill, should it pass, are as nimble and dynamic as the technology itself. Make no mistake, if and when the bill passes—hopefully, during fall sessional days this year—we will just be beginning the conversation with each and every one of you, as we work in common cause toward getting that balance of deploying the technology in a positive way, but at the same time, putting up the appropriate safeguards. With this proposed legislation, which we hope to pass this session, as I indicated, Ontario would become one of the first jurisdictions in Canada to regulate these three key pieces of digital security, in the public sector: those being cyber security, data protections, and the use of artificial intelligence.
Now, when it comes to strengthening cyber security, we know that the best type of response is one that is coordinated and proactive. Should the bill pass, we would propose sector-specific requirements, that could include mandatory cyber incident reporting to government, and tools to enhance cyber resiliency across the entire public sector. Cyber threats do not adhere to jurisdictions, industries, or any confined space. And so, it is imperative that we work across all levels of government to identify, stop, and mitigate the impacts of a cyber attack. And by working together, we can and will achieve this.
As many parents in the room are likely to understand, our children are at the greatest risk of harm posed by digital technology. Unscrupulous criminals, who engage in cyber crime, often target children’s data. This is disgraceful. And so, we owe it to our children, to ensure that their futures are secured, by protecting their sensitive data from being stolen by criminals. That is why the proposed Bill 194 includes enhanced privacy safeguards, to establish ways to better protect children from inappropriate data use in schools, and Children’s Aid Societies—including Indigenous Child and Family Agencies. For our children, and indeed for all Ontarians, we must ensure that our protections and our guardrails keep pace with rapid technological advancements. That is why we owe it to our children, never accepting complacency, and putting their best interests first and foremost, always.
Additionally, the bill also introduces measures to modernize our approach to privacy protections. With cyber incidents on the rise, Ontario is enhancing the authority of the Information and Privacy Commissioner, to investigate privacy breaches, and to enforce stricter standards across public institutions. By mandating privacy impact assessments, we are prioritizing the responsible use of personal data. These measures will be integral, in ensuring that privacy is at the forefront of every digital interaction within our public sector.
Now, the final pillar of Bill 194 is safeguarding the responsible use of artificial intelligence. Ontario is at the forefront of responsible AI governance, with this legislation. And Bill 194 lays out the foundation for transparent, ethical AI use, within our public sector. By establishing clear guidelines and accountability measures, we can ensure that artificial intelligence is deployed to serve Ontarians, while upholding privacy and trust. Artificial intelligence has immense potential to transform public services, and Ontario is committed to realizing this potential safely, responsibly, and ethically. Government and industry are leveraging AI, in their operations; they are doing so to increase efficiency, and expand their range of products and services, rightly so. And our government fully recognizes the incredible opportunity technology like AI offers our province. And that is why Bill 194, if passed, would ensure the responsible use of AI in the public sector, while also supporting the growth of a safe and prosperous digital economy. This landmark bill is of critical importance, not only to Ontario’s digital economy, but to the safety and security of our residents, our children, and indeed, our entire province.
Every day that we do not take proactive measures to safeguard our province’s digital infrastructure is yet another day that we would remain open to attack. Cyber attacks are the latest challenge that our province and our nation must defend against. And I’m confident that Bill 194, if passed, would be the armament we need to protect our province, and to lead our country, in the face of cyber criminals. Simply because we do not see these enemies does not mean that they are not there. And through this legislation, we would deliver a strong message to these cyber criminals, that Ontario will not be a victim of their malicious crimes.
Over the course of the past several months, it has been my honour to meet with a variety of organizations in Ontario’s business and technology communities, to share highlights of Bill 194, and its impacts. I met with boards of trade and chambers of commerce in Brampton, Ottawa, Mississauga, Markham, and Windsor. I also hosted a round table with Communitech in Kitchener, a support organization for tech startups. These sessions aim to raise awareness about how our government is safeguarding digital privacy and data, and to gather valuable feedback, as we develop potential regulations, should the bill pass. The broad support we have received from the various stakeholders we engage with signify the timeliness and importance of this work. And I’m honoured to continue these engagements, and dig deeper in the regulations phase. And I’m grateful to the members of the Vector Institute for their research, advice, and guidance.
These round tables and the engaging open conversations that they enable are incredibly valuable, as we work together to protect Ontarians in the months, and indeed, the years to come. It is vital that we openly communicate across all levels of government, all regions, and all sectors of the economy, to ensure that there are no gaps in our fortifications against cyber threats. We are committed to engaging and working in lockstep with partners, now, and into the future, so that the people and our businesses in Ontario can trust that the right protections are in place, to confidently and safely participate and thrive online—as I said, the passage of Bill 194 would be the beginning of further conversations. By maintaining an open dialogue with partners over time, the government is committed to adapting, to meet the changing needs of our people and our businesses, ensuring protections remain relevant and effective, and fostering trust in that digital landscape that we all rely upon.
In September of this year, at the Federal Provincial and Territorial Symposium in St. John’s, Newfoundland, I had the privilege of meeting with my counterparts from across Canada, who are responsible ministers for digital trust and cybersecurity. We discussed three fundamental areas: cybersecurity, digital trust and of course, artificial intelligence. It was a wonderful opportunity to showcase Ontario’s strong leadership on these three critical areas, and to report on the decisive actions we are taking here, to build digital trust. My counterparts across the country were quite pleased to hear about our Bill 194, and we had many productive conversations about interprovincial alignment on cybersecurity. That is essential. All jurisdictions agreed on the paramount need to cooperate in the development of strong digital trust, strong digital trust frameworks, to ensure our residents are safe online. We committed to working alongside each other to build a stronger, safer, and more resilient digital future for Canada. And I am pleased to report that due to our strong, thriving, regulatory and tech ecosystems, as well as having some of the greatest tech talent in the world—like those at the University of Toronto, and in Kitchener-Waterloo, and indeed, within the walls of our ministry—Ontario is proudly leading the way.
I wish to leave you, now, with this snapshot of our promise for tomorrow. Our future is one where Ontario stands as a beacon of digital resilience. Where our public institutions are fortified, our children’s data is secure, and our healthcare and education systems operate without fear of digital disruption. This is the future we are building together. Our government’s commitment to innovation and security will ensure that we continue to reap the benefits of a digital society, while protecting the privacy and trust of every Ontarian. We have the technology, we have thoughtful leadership, we have the vision, and we have the determination. Above all, we are on the right side of history, with the values that will guide us to triumph over the cyber criminals, who seek to undermine our ability to keep our residents, and our critical infrastructure safe.
I have no doubt that together, through this legislation, we can build a more secure and resilient digital society for generations to come. And I thank you for being part of this journey, and for your commitment to strengthening Ontario’s digital future. Together, we are laying the foundation for a safer, more secure, and more prosperous Ontario. One where we can all confidently embrace the future, knowing that our government, and our partners, are steadfast in their commitment to our safety and our security. I am honoured to continue this essential work with all of you. Thank you for your kind attention.
Jenna Donelson
All right. Everyone can hear me? Wonderful. Minister, thank you.
The Hon. Todd McCarthy
And testing one, two, three? I’m….
Jenna Donelson
Testing one, two, three. We’re all good. Someone’s given us…
The Hon. Todd McCarthy
Oh. Mic is working now. Okay. That’s good.
Jenna Donelson
Someone will tell us if we’re not. Minister, thank you. You walked us through a very comprehensive bill, some core pillars. I’d love to dive into some of them with you.
The Hon. Todd McCarthy
Okay.
Jenna Donelson
Let’s start with the tech sector. I think many of us view the tech sector, whether it’s in healthcare, or other forms of tech, is really crucial to Ontario’s future economic prosperity. Walk us through how you were thinking about balancing, spurring that economic development, supporting it, while addressing real cyber threats, and real privacy concerns, in Bill 194.
The Hon. Todd McCarthy
Well, thank you, Jenna. Your question has the right word in it: balancing. That’s the key. You know, Premier Ford, members of our government, do not—as you know from our track record—appreciate overregulation or too much red tape. Yes, the reality is that we have a mixed economy. Government has a role in that mixed economy. But at the same time, this is a free and democratic society. It is a society where government can and must create the conditions for the private sector to succeed and prosper. Government doesn’t create jobs, for example, but government creates the conditions for jobs to be created by the private sector.
The tech sector is no exception. We don’t want to stifle initiative, and innovation, and investment. And in fact, I think it’s through government working in a balanced way, with our tech sector partners, that we’ve seen the growth in the tech sector, right here in Ontario. So, we are number three in North America, we are number one in Canada; we have well upward, well over 400 tech startups, here in Ontario. And many of our women and men have returned to Ontario with their tech sector knowledge, from places like Silicon Valley, to engage here in our private sector. So, we’ve got to get that balance right. And the balance is, yes, we embrace the new technology of artificial intelligence, and what the tech sector has to offer, the unlimited potential of that in our digital world. But at the same time, we have to put in place—and this is government’s role and duty—in conversation with the private sector, and our partners in academia, and other industries, to safeguard our children and our vulnerable.
So, this bill attempts to strike that balance right. Creating the conditions for continued momentum and growth in the tech sector, but making sure that artificial intelligence is deployed responsibly, transparently, and with the appropriate mitigations in place. And we can lead by example. And how the trust that we have to build is because each individual citizen, in each business, in interacting with government, has to have trust and confidence. No AI in secret, AI transparency all the way, and accountability, always subject to good human judgment, and always subject to regular risk assessments. Because irresponsible use of AI technology is not good for anyone. But I have great trust, and our government has great trust, in our tech sector, and in the investments and innovations that are going on right now. And it’s when government and the private sector work together that we have the ultimate success.
Jenna Donelson
Fantastic. I wanna get into responsible AI use in government, in just a second, Minister.
The Hon. Todd McCarthy
Sure.
Jenna Donelson
I neglected to mention, if you have a question for the minister, please send it through. Those of you online, those of you in the room, I’ll be keeping an eye on them. So, Minister, you talked in your speech about how many in the business sector are deploying AI, at the moment. And part of what you’re contemplating in the proposed bill is the use of AI in government. Of course, we know that there is tremendous potential opportunity here, for efficiency, for productivity. But that doesn’t come without risks. So, how are you thinking about deploying this in the government, in the public sector, to once again, balance that opportunity against those risks? How are you managing that?
The Hon. Todd McCarthy
Well, I think AI is, is like any new technology that’s rapidly advancing. It has huge potential and huge opportunity, and huge potential for rewards to make our society better, to make us better in all that we do, to create new job opportunities that were previously unimaginable, even a decade ago. But at the same time, we have to learn from history. And I’m a student of history. I think of—and I talked to you, Jenna, about this—when I was young, like many of you, our parents limited our viewing time on television, make sure your homework was done, and so forth; not having television that isolates young people. We learned from the lack of regulation of social media, beginning 20 years ago, what happens when you have the Wild West, and how harmful that can be to our children. So, it’s important, when you work toward a better and brighter future, that you learn from history. What did we fail to do? What did we get right? And in this instance, we know that government has to be the, the agent of providing safeguards. And so, this bill leads with the protection of children first and foremost.
The first iteration of the bill, in terms of regulating the use of artificial intelligence in the public sector, and broader public sector, focuses on schools, school boards, hospitals, and Children’s Aid Societies. And that’s because it’s deliberately designed to protect children, first and foremost. Yes, we look to other jurisdictions, to see what’s going on there. We know in Australia, there’s a proposed ban on social media use for any child under the age of 16. You know, should we have no-go zones, when it comes to artificial intelligence? I personally think that that is absolutely something that should be on the table.
But again, we have a confederation. We have a federal system of government. There are, there are matters within the federal government’s jurisdiction, like the regulation of the private sector, that is their constitutional responsibility. So, quite frankly, you know, I’m concerned that the present federal parliament is, is mired in inertia at the moment—and that’s not a political or partisan statement; it just is what it is—they have three bills that are not gonna be passed in this parliament. We have more stability in Ontario’s 43rd parliament to get our bill through, and we’re gonna do that, I hope unanimously so, because it is a nonpartisan endeavor.
But the reality is that the private sector, the idea of no-go zones for AI, is something that only the federal government can do. But that’s why the cybersecurity conference in St. John’s was so important, because of the conversations that I could have with my federal counterparts, and my provincial and territorial counterparts. But make no mistake, when we look to other jurisdictions, when we have conversations across government with the private sector, with industry, academia, and experts, we have to—we are being looked to, Ontario is being looked to, as a leader. So, what we do with Bill 194 will help continue the conversations, and I’ll certainly continue to engage with the federal government, to make sure that that level of government acts swiftly on areas like no-go zones, and I’m happy to be part of that conversation, and do what we can as a provincial government constitutionally, to do our part.
Jenna Donelson
Fantastic. And you mentioned that your colleagues are looking to Ontario as a leader, but you also just touched on a couple other jurisdictions that are leading the way. Who is Ontario looking to? Are they looking to Australia, the UK, the EU, on some of these things, some of the legislation that’s come in, around social media and kids? Are you contemplating bringing elements of that into the bill, when it moves through the process?
The Hon. Todd McCarthy
We’ve been privileged to have many conversations with many representatives of different jurisdictions. There’s no monopoly in a good idea, as the Premier is fond of saying. And there’s no particular jurisdiction that we’re necessarily focused on; we just look for good ideas. And again, recognizing that, sometimes, as a provincial government, what we can do is lead in what we have responsibility for. We can’t stray from our lane, constitutionally. Even though, I used to be a litigator, I didn’t mind going before the courts, but I’d rather avoid constitutional squabbles. So, I think that’s the idea here, is conversations to get the balance right, with regulating AI use and cyber security protections, but also, unleashing the potential for the private sector, the tech sector, but also, conversations with other levels of government. I said in my speech, that has to be the engagement. And we wanna make sure that the federal government has the support of all provinces and territories, in these conversations, so that that level of government does its duty, in terms of protecting the most vulnerable, and regulating, where it can constitutionally regulate.
Jenna Donelson
Fantastic. Let’s get back to Ontario, as a leader…
The Hon. Todd McCarthy
Okay.
Jenna Donelson
…particularly in cyber crime.
The Hon. Todd McCarthy
Yes.
Jenna Donelson
Which, I think, is of interest to a lot of us here, before we get to some of the questions from the audience. How were you contemplating some of these actors, whose roles are evolving—whether they’re state actors, non-state actors, the tactics, the approaches are evolving very rapidly. How did you get in their heads, and think about how they’re thinking, when you contemplated the tools that the government needs, the broader public sector needs, in combating cyber crime?
The Hon. Todd McCarthy
Well, let’s make sure that we understand who we’re talking about. We are talking about state actors—you touched on that, in your opening remarks. There are states, there are nation states, that seek to disrupt and, quite frankly, incapacitate our civil society, whether it’s election interference, or disrupting infrastructure, or vital public services. Very, very dangerous. This is a new type of warfare. There is no blinking at the fact that this is a new type of terrorism, and potential warfare, and we have to be on guard. Because it’s a threat to our national security. So, there’s hackers, of course. There are those who seek financial gain, with cyber incidents and attacks. And then, there are the more sinister criminals, terrorists and nation states, that are a threat to Canada and Ontario.
And so, Ontario, having 40% of Canada’s population, one of the—the largest government, other than the federal government in Canada, one of the largest governments in North America, I might add, is under attack. And that’s why we’ve had in place, for many years, a cybersecurity operations centre for Ontario alone—of course, there’s a national one, as well. But we absolutely, have to stand shoulder-to-shoulder with each other, in this common cause. I don’t think I can raise the alarm bells enough about this. That’s why we’re leading as we can, and we will continue to stay ahead of the curve on this.
Resilience is one thing, to be able to recover from attack is one thing. But staying ahead, so that we’re beating them at their own game before the attacks happen, is absolutely crucial. So, our bill proposes centralized reporting of all cyber incidents within the public sector, broader public sector. It imposes mandatory cyber standards, across government. I use the word fortified. This bill will ensure that we are sufficiently fortified in government, within Ontario’s largest provincial government, against these attacks. Because that is our duty, as government. That doesn’t mean we’re gonna get in the way of private sector initiatives, and private sector growth, and the success of the tech sector. That’s striking the right balance.
QUESTION & ANSWER
Jenna Donelson
Good point. On that note, I’m gonna summarize one of the questions we have here. You talked a lot about consultation with the private sector, and other key organizations, that have a stake in this. You mentioned in your speech sort of the start of that, that that’s meant to be iterative, as the needs and responses evolve. Can you walk us through, a little bit more, Minister, how you approach those consultations, how you envision that, moving forward?
The Hon. Todd McCarthy
Well, I did talk about consultations and conversations entering another phase, just a new beginning, if the bill passes. And that’s important, because every bill, of course, contains regulation-making authority, “the Minister may,” or “the Minister can,” or “the Lieutenant Governor and Council—meaning Cabinet—can,” but that’s standard. But in this bill, as proposed, there is directive authority. So, the Minister of Public and Business Service, Delivery and Procurement, can issue directives, which bind all ministries of government and the broader public sector, hospitals, school boards, Children’s Aid Societies, and later, municipalities—because they’ll be in the next iteration of the legislation.
And that is a, that is an unusual feature of this bill. But it’s designed to make sure that the standards are adhered to, across government, and that there’s strong enforcement ability. But it also is a call-to-arms. Because if the phrase, “If you see something, say something,” ever had relevance—which it does—it certainly has relevance to cybersecurity. Because we’re all in this together. We’re only as strong as our weakest link. It’s never acceptable to not report what you see, as an individual, within an organization, to your Tech Lead. That’s very important. And this will have those strong enforcement powers.
And the other schedule, of course, will be the Information and Privacy Commission reform. I mean, the Freedom of Information Protection Privacy Act in Ontario has not had a major overhaul since I had a brick cell phone, with the antenna attached to it—that’s about 30, 33 years ago. So, it’s time to update that act for a digital age. And the authority for the Information and Privacy Commissioner is because it’s so critical to have cybersecurity privacy protection, data protection, the ability to pursue risk assessments; the whistleblower part of the schedule within the bill, very, very important, as well as the responsible use of AI. So, those enhanced, updated, digital era provisions respecting the Information and Privacy Commissioner’s Office, are an essential part of this bill, as well.
Jenna Donelson
And actually, we have a question that gets to some of that…
The Hon. Todd McCarthy
Yeah.
Jenna Donelson
…in more detail. Question from our audience: what is the government’s approach to compliance enforcement? You know, that’s often, with different sectors, being pushed to regulators, sometimes effectively enforced, not effectively enforced. What’s your approach to enforcement, on the compliance side of this?
The Hon. Todd McCarthy
The first is a call-to-arms: we’re all in this together. It’s not government coming down on its citizens, or the public sector, broader public sector, or stifling initiative; it’s about all of us being in common cause. So, that is the first part of what this bill is about. It’s, it’s a positive, let’s, very similar to the wartime, “Loose lips, sink ships,” right? If this is a matter of national security, as it is, if this is a new type of warfare, as it is, then we all depend on the success of security measures, in the cyber world.
But there will be enforcement powers, when it comes to data and privacy protections, through the schedule of the bill that deals with the update to the Freedom of Information and Protection of Privacy Act, make no mistake about it—and I’ll, I won’t apologize for that; that’s the way it ought to be. And again, with directive authority to follow, under the bill. But again, never without having a conversation, never without multiple conversations. I’m gonna say not only is this a call-to-arms, but because we’re all in this together, I or whoever the next minister of this ministry may be, will depend upon the good advice that I’ve already received, and will continue, hopefully, to receive from industry, from academia, from experts, from those within and outside government who care about our civil society, and the protection of our society, and the enhancement of our society, so that we can thrive in the digital world.
I am a glass-is-half-full kind of individual, so I’m more optimistic than ever before that we can harness the digital opportunities that we have, the opportunities with artificial intelligence, to make our society better, to improve the delivery of government services, to improve the success of the private sector. But at the same time, we always have to be on guard for how certain technology can and will be misused by criminals. But we all are in this together, and the act will allow us to not only lead Canada, but be an example, I think, a beacon to North America, and indeed, the world. So, I’m quite proud to share the principles and the goals of Bill 194 with all who are ready to listen.
Jenna Donelson
Fantastic. Well, I think that leads us really nicely into our last question, Minister. How do you envision the bill? Any further comments you wanna make, on how it will support and spur economic development and innovation, particularly in Ontario’s AI and cybersecurity sectors?
The Hon. Todd McCarthy
Well, I think it’s just the reaction that I’ve received, since tabling the bill in May, such enthusiasm for it, that it’s well needed. And I can tell you, we didn’t just make it up. Long before I was appointed Minister of Public and Business Service Delivery and Procurement last year, our ministry officials were working diligently on the bill. So, it’s a creation of much input, from those who know much more about it than I. In my career before, as a trial lawyer, I wore 19th century gowns to court. So, who knew that I’d be heading a ministry in charge of AI and cybersecurity. But I’m very proud of our ministry officials, the work that they did. I mentioned the Vector Institute, and many others, who’ve advised the government on this. We’ve had the AI Expert Working Group, leading the input on this legislation. And we’re benefiting, since the bill was tabled, from lots of input from individuals, from private sector, from experts, academics, and even the Law Commission of Ontario has, has weighed in, and I welcome that. And we’ll have more input, after I make my opening remarks Thursday morning, at the Justice Policy Committee, we’ll have more input this week and next week from other stakeholders. So, I look forward to that.
So, that’s a long answer to your short question. But my short answer to your question is that the enthusiasm, the optimism associated with the bill, that it is overdue, and that Ontario is leading Canada on this, and the fact that other provinces and territories say, well, if Ontario can do it, we can, too. And I literally, physically, distributed the bill to my ministerial counterparts, and they greeted it with great enthusiasm. So, it doesn’t mean that it’s absolutely perfect; doesn’t mean that we don’t welcome some amendments at committee—because those are helpful, and we’ve already received some good advice on that—but I think the finished product, when it emerges from committee, will be embraced. But again, I urge you all, work with government, work with Premier Ford, and myself, and our cabinet, on getting those directives just right. Because the technology is evolving so rapidly, that the directives are designed to allow us to remain nimble, and to be ahead of the cyber criminals, and ahead of the advancing technology, as we move forward into 2025.
Jenna Donelson
Minister, you have a room full of people that are keen to engage with you on this. I’m sure, moving forward, not to mention the call-to-action you have, for those of us who are yet to jump in. So, thank you, Minister, for diving a little deeper with us. I know your bill’s in process. I wish you all the best, as it goes through…
The Hon. Todd McCarthy
Thanks, Jenna.
Jenna Donelson
…and we really appreciate your time today.
The Hon. Todd McCarthy
Appreciate it. Thank you.
Jenna Donelson
You can take a seat. Thanks, Minister. Great job. If you want, you can take a seat down there. All right. Thank you, again, Minister, for taking the time to come here today, to lay out those, that important roadmap, and those pillars in our approach to digital security.
It is now my pleasure to introduce another leading voice in cybersecurity, and supporter of today’s event. Please extend a warm welcome to Jeanette Patel, Director of Government Affairs and Public Policy at Google Canada. Come on up, Jeanette. Nice to meet you. Thank you so much.
Note of Appreciation by Jeanette Patel, Director of Government Affairs & Public Policy, Google Canada
Of course. Thank you. Well, hello, everyone. On behalf of Google Canada, I want to thank you, Minister McCarthy, for your time, and thoughtful remarks today. You know, your comments reflect the values and approach that we take at Google, when we’re developing the products and services used by millions of Ontarians, and billions of users around the world. At Google, we recognize the vital role of cybersecurity in maintaining public trust, particularly, in the digital services that are provided by the public sector. We’re proud of our work to develop and deliver educational tools, that empower educators to be innovative with their programming, all with safety and security as the foremost consideration. We believe that technology should serve the public good, and empower individuals and communities. And this belief underscores our commitment to developing and deploying AI systems that are safe, secure, transparent, and accountable.
To that end, I’m pleased to share that in June, Google introduced our secure AI framework, or SAFE, to help organizations ensure that the AI tools that they build and deploy are themselves safe and secure by default. Our aim with SAFE is to build a coalition of partners, to drive adoption of strong security principles and practices, throughout the AI ecosystem. We’re partnering with, listening to, and sharing expertise with governments around the world, to inform standards and best practices. There is no doubt that AI will be an important element in supporting public servants, in the work they do to serve Canadians. Through innovative tools and cloud-based technology, we look forward to working with the Government of Ontario on cybersecurity, privacy, and service delivery. We’re looking forward to working alongside you, Minister, and other legislators, on proposals that promote responsible AI development and use, and to find the right balance between protecting Ontarians, while still giving them access to the products and services they love, and enabling innovation across both industry and government. Working together, I know we will achieve that balance. So, thank you again for your leadership, and collaboration.
Concluding Remarks by Jenna Donelson
Thank you, Jeanette, for those great remarks. And thank you to everyone who joined us here today, both here in person, and those of you online. We appreciate you taking the time out to have this important and critical conversation on our future digital security. I’d also like to take a moment to recognize the students and young leaders in the room, who are at the Bell table. Thank you for joining us. We’ve got students from TMU, from Queens, from Humber Polytechnic, and from U of T. We’re glad you’re here. Thanks for joining us today. And thanks to Bell, for your support of our students.
If you’d like to stay connected, please subscribe to our newsletter by scanning the QR code that’s found on your table. I hope to see many of you at our upcoming events. On December 2nd, we are hosting, Minister, your colleague, the Honourable David Piccini, Minister of Labour, Immigration, Training, and Skills Development. He is coming for a much-anticipated discussion on growing the workforce Ontario needs to drive our future prosperity.
And on December 17th, we have Danielle Smith, Premier of Alberta, and Andrew Furey, Premier of Newfoundland and Labrador, coming together for a timely conversation on the energy trilemma, sustainability, affordability, and reliability, how we address those, moving forward. Each Premier will deliver remarks, before sitting down for a moderated discussion that will continue to understand, expand our understanding, and get to the heart of this national discourse we have. Tickets for both events are available now, so please get them, as soon as you can.
As a club of record, the Empire Club events are all available to watch and listen to on our website. A recording of this event will be available shortly. Thank you all for being here today. I wish you a wonderful afternoon. This meeting is now adjourned.
