ISED ‘digital charter’ recommends enhancing OPC powers

Innovation Canada is recommending that the privacy commissioner be vested with order-making power to clamp down on non-compliance related to the collection and use of Canadians’ personal information. The suggestion is among recommendations resulting from the government’s review of Canada’s national data strategy, launched last June. Fitting under its new “digital charter” initiative, announced Tuesday, the proposed powers can be used by the commissioner “to halt collection, use or disclosure of personal information” by a non-compliant organization, and can be used in a situation where delinquency is likely to “cause a risk of harm or significant distress to an individual,” the department said in a document proposing to modernize the Personal Information Protection and Electronic Documents Act (PIPEDA). Currently the OPC has investigative powers, where it can issue a report with recommendations or enter into a compliance agreement. Where it still finds bad behaviour, it can go to Federal Court to seek an order for remedies or damages. The law requires the OPC to educate organizations and individuals on PIPEDA, conduct research, and make guidance and develop codes of practice. Those existing practices would be enhanced under the proposed rules, which would see the OPC have “increased discretion” to investigate complaints of a wider variety and provide more latitude for reviewing organizations, including periodic check-ups. ISED says effective enforcement has four components: education and outreach, investigations and audits, proactive advice and dialogue, and tools to address non-compliance -- which include the administration of penalties. But while the document explicitly recommends order-making powers, it does not do the same for fining powers. ISED did not get back in time for publishing to clarify this point. “There is a growing view that the ombudsman model and enforcement of PIPEDA, which relies largely on recommendations, naming of organizations in the public interest, and recourse to the Federal Court, to effect compliance with privacy laws, is outdated and does not incentivize compliance, especially when compared to the latest generation of privacy laws,” ISED said in a document outlining the proposals. “The current state of affairs cannot continue,” it added. “Meaningful but reasoned enforcement is required to ensure that there are real consequences when the law is not followed.” Order-making and fining powers have been proposed before, in House of Commons committees, by the head of Elections Canada, and by the commissioner Daniel Therrien himself. But the suggestions were never adopted by the government. The proposed changes to PIPEDA include “substantially increasing the range of fines that are tied to offences under the Act” and extending those fines to areas of the law including consent requirements, data safeguard requirements, limiting use, disclosure and retention requirements. “Further empowering the Court to order statutory damages for certain contraventions” is another recommendation. “PIPEDA could be amended to prescribe a range of damage awards, setting out minimum and maximum amounts for contraventions of specific provisions.” Drew McArthur, British Columbia’s acting privacy commissioner, previously told a House ethics committee in 2017 that larger fines are required to deter breaches involving personal information. He was talking about the up-to $100,000 fine that companies face if they don’t inform customers about personal data breaches. Breach reporting rules came into force late last year. There are two categories of offences applied by the courts, according to ISED: a summary offence, which means a fine that doesn’t exceed $10,000 per offence and an indictable offence, netting no more than $100,000 per offence. ISED also said the government is also studying potential reforms to the Privacy Act, which handles how federal institutions handle personal information. Overall, the proposals seek to put more control in the hands of Canadians when it comes to their personal information. They include “requiring specific, standardized, plain-language information on the intended use of the information, the third parties with which information will be shared, and prohibiting the bundling of consent into a contract.” Beside control and consent, the digital charter outlines nine other principles, including universal access to the digital world, safety and security, an open and modern digital government, and digital platforms free from hate and extremist content. — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

ISED ‘digital charter’ recommends enhancing OPC powers

News | May 21, 2019

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

ISED ‘digital charter’ recommends enhancing OPC powers

News | May 21, 2019

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Watchdogs find deceptive privacy practices across majority of websites, apps studied

Privacy tribunal unlikely to get through INDU’s look at Bill C-27

Privacy tribunal needed in Digital Charter, ISED continues to tell MPs

Privacy commissioner flags excessive site blocking, privacy risks in age verification bill

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us