Gov’t tables PIPEDA reform, new consumer privacy legislation

The federal government introduced sweeping private-sector privacy law reform Tuesday, giving the privacy commissioner long-asked for order-making powers and creating new legislation and a new administrative tribunal to govern online privacy. Bill C-11, the Digital Charter Implementation Act, would update the Personal Information Protection and Electronic Documents Act (PIPEDA). If passed, it would create a new piece of legislation, the Consumer Privacy Protection Act (CPPA), that the government said would ensure greater control and transparency over how companies handle Canadians’ private information. PIPEDA would be renamed the Electronic Documents Act. Speaking to reporters Tuesday morning, Innovation Minister Navdeep Bains said the legislation would give Canada adequacy status under the European Union’s privacy regulations, the GDPR. That means EU citizens’ data can continue to be processed in Canada, something that has for years been a factor in discussions about how to update Canadian privacy law. Privacy commissioner Daniel Therrien said last month that Canada’s adequacy status was at risk if the government didn’t move to update the laws. The privacy commissioner has long been asking for order-making and enforcement powers. Tuesday’s legislation would empower the OPC to order organizations to comply with the legislation and stop activities that are in contravention of the legislation, among other measures. However, it gives only indirect powers to recommend a fine. Instead, it creates a Personal Information and Data Protection Tribunal which would decide on the penalty. The government didn’t provide further details about how that tribunal would be set up and administered. A fact sheet outlined that the tribunal could levy “administrative monetary penalties of up to 3% of global revenue or $10 million for non-compliant organizations,” while offences considered serious contraventions would be “subject to a maximum fine of 5% of global revenue or $25 million.” Those are the “strongest fines among G7 privacy laws,” according to the press release. The administrative tribunal will also hear appeals of some OPC decisions, the legislation states. Last year Therrien criticized the Digital Charter as a weak attempt to strengthen Canadian privacy law and the enforcement mechanisms of his office, saying that it still left his office with less enforcement power than his counterparts in other countries. In an emailed statement Tuesday, Therrien said he’s still studying the new bill. “Bill C-11 is a complex and substantial piece of legislation. We recognize that some of the elements we had recommended appear in the legislation tabled today. However, before offering more detailed comments, we will need to carefully assess how its several components work together and how well they would improve protections for the privacy rights of Canadians,” he said in the statement. “We look forward to presenting our views to Parliament as it undertakes its study of this important bill.” Among other measures in the new bill are stipulations that Canadians have the right to ask one organization to share their personal information with another, as well as to ask organizations to destroy that information. The bill would also ensure individuals “have the plain-language information they need to make meaningful choices about the use of their personal information,” the government said in a fact sheet. The new legislation also says businesses must be transparent about their use of technology like algorithms and artificial intelligence. “Individuals would also have the right to request that businesses explain how a prediction, recommendation or decision was made by an automated decision-making system and explain how the information was obtained,” the fact sheet outlined. That doesn’t go as far as the recommendations the OPC issued just last week which called for Canadians to have the right to contest those decisions. Internet advocacy group OpenMedia praised the new bill in a press release, but both it and consumer group the Public Interest Advocacy Centre expressed some concerns about how the bill treats consent. OpenMedia noted that “consent is not required when the organization does not have a direct relationship with the individual, alongside other business need exceptions. If interpreted broadly, these limitations could significantly reduce the bill’s practical protections.” PIAC, meanwhile, was stronger in its criticism of exemptions in section 39(1) of the bill, which state that cases where an organization may disclose personal information without an individual’s knowledge or consent include instances where that information is de-identified, if the information is disclosed to a government institution, a health care, post-secondary institution or public library, or if it’s for a socially-beneficial purpose. The bill defines a socially beneficial purpose as “related to health, the provision or improvement of public amenities or infrastructure, the protection of the environment or any other prescribed purpose.” PIAC’s executive director John Lawford said in a release: “We are aghast that the federal government feels it can weaken consumer privacy with a doublespeak Bill that removes a consumer’s right to protect his or her personal information that is used for any ‘business activity’ if it is ‘de-identified’ or used for what the government deems is a ‘socially beneficial purpose.” Lawford said in an email that the wording could be interpreted to include telecom companies who received government funding and contracts to build out rural broadband infrastructure. Both the federal government and the CRTC currently are currently funding such projects, with Innovation Canada recently launching its $1.75-billion Universal Broadband Fund. That means companies who received such funding could share de-identified information with organizations including the government, health authorities, universities, libraries, even other companies who received broadband funding, Lawford said. “This puts enormous pressure on the de-identification process AND takes away consumers’ present rights to near absolute confidentiality (de-ID’ed or not) of their telecom habits and uses,” Lawford said in an email. — Reporting by Anja Karadeglija at akarad@thewirereport.ca and editing by Michael Lee-Murphy at mleemurphy@thewirereport.ca

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Gov’t tables PIPEDA reform, new consumer privacy legislation

News | November 17, 2020

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Watchdogs find deceptive privacy practices across majority of websites, apps studied

Meta considers blocking Facebook news in Australia

Rizwan Jamal leaves Xplore to become CEO of Beanfield

Internet service quality bill becomes law

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us