New privacy legislation mixed bag in terms of enforcement, experts say

When the federal government’s proposed new privacy legislation, Bill C-11, was announced in November, Innovation Minister Navdeep Bains billed it is an “important step” towards a system “founded on trust with clear rules and enforcement.” So how effective are the enforcement measures included in the legislation, which would make sweeping changes to Canada’s private sector privacy rules? Experts consulted by The Wire Report were broadly in favour of the new provisions for large fines under C-11, the new order-making powers for the federal privacy commissioner, and changes that would allow for class action lawsuits against companies that violate the proposed Consumer Privacy Protection Act. However, the creation of a new pseudo-judicial body to issue verdicts on data privacy issues, the Personal Information and Data Protection Tribunal, is more divisive, with some indicating that it dilutes the privacy commissioner’s new powers, and others suggesting it represents a reasonable separation of duties. New Penalties Arguably the least controversial element of C-11 (at least in terms of efficient enforcement) is the inclusion of new penalties for companies found in breach of the proposed CPPA. Bains has indicated that Canada looked to the European approach for guidance in determining penalties under Bill C-11, and following the EU’s approach, C-11 sets penalties at a maximum of $25 million or five per cent of an offending organization’s annual global revenue, whichever is higher. In comparison, the EU’s maximums are €20 million or four per cent of global revenue. These fines will be recommended by the privacy commissioner, but handed down by the new tribunal; the tribunal will also have the right to adjust those fines. Tamir Israel, staff lawyer at the University of Ottawa’s Canadian Internet Policy and Public Interest Clinic, says that while the potential fines are numerically high, it’s a necessary measure to encourage compliance from big, multinational data handlers. “We are talking about multibillion dollar companies. The incentives to really push the line on privacy are very, very intense…when the companies look at compliance with the Act, there's always a bit of a gray zone and the incentive to err on the side of whatever they want to do is extremely high. So you need something to really counterbalance that,” he said in a phone interview. Furthermore, it’s unlikely that higher-end fines will be handed out frequently. Bill C-11 requires that the commissioner take several factors into account: the scope of a contravention, whether an organization has paid compensation, and an organization’s history with data or privacy laws. “The higher end penalties are going to be available for very blatant violations of the clear law that are very systemic and have a wide, wide reaching impact. So it's not every breach that’s going to be three percent of the organization's global revenue,“ explained Israel. Speaking to The Wire Report, minister Bains confirmed that the aim of the fines is compliance, rather than monetary penalties for their own sake. “Canadians don’t want companies to face significant fines, Canadians want companies to follow the law. Canadians want companies to respect the law. And they know that because we have the highest fines amongst the G7 countries for privacy laws that there’s accountability,” he said. New powers for the privacy commissioner Under C-11, the privacy commissioner will not be granted the right to hand down fines (only to recommend them), but the commissioner’s office will acquire other new powers, most notably, the ability to issue binding orders to companies dealing with consumer data. It’s also the only enforcement measure that the OPC has actively commented on — when Bill C-11 was tabled in November, the commissioner’s office issued a statement that appeared to tacitly praise the order-making powers. “The Bill would give the OPC real order-making powers, rather than the more limited powers proposed in the government’s 2019 Digital Charter,” the statement noted. (The OPC declined to comment any further to The Wire Report about this or any other enforcement provisions in Bill C-11, pointing only to this statement.) Former Ontario privacy commissioner Ann Cavoukian also welcomed the order-making powers (although she expressed disappointment at other “weaknesses” in the bill), saying that they have proved a useful tool for provincial privacy commissioners. “The other side always knew I had available., so they were much more likely to engage in an exchange of informal resolutions, sit at the table and work it out. I always preferred that outcome...but you need the strength of order making power to get them at the table because they know you can order them to take certain actions.” According to Eoin O’Dell, an associate law professor at Dublin’s Trinity College who has studied privacy legislation and enforcement internationally, these orders can be more impactful than monetary penalties. “Sometimes how you hit a company in its pocket is restraining its business practices. If you're an oil company and you're told, stop pumping oil, that’s it, you don't have a revenue stream. If you're a data company and you're told stop processing data, again, that's hitting your revenue stream,” he said in a phone interview. O’Dell added that such orders can be particularly effective on large companies whose business centres around data, such as Alphabet Inc. “Google doesn't worry too much about a $50 million fine because a lot of their antitrust fines are in the billions. But they do worry about not being able to process the data, because that's the basis of the revenue stream.” However, O’Dell noted that enforcement (through orders or other mechanisms) could be harder to manage in Canada by the fact that there are few offices focused on privacy and data protection that hold equivalent powers below the federal level, with provincial privacy commissioners only present in B.C., Ontario, and Quebec. “Those are gaps because it's a long way from an individual action to a federal regulator.” However, due to constitutional separations of power, certain data and privacy complaints and orders stemming from them can only happen at the federal level, for example, issues in the banking sector. To manage the new order-making powers and compliance with the CPPA, minister Bains indicated to The Wire Report that the OPC will be given more resources. “Absolutely, we would increase the resources because we want the commissioner to focus not only on order-making powers properly pursued but also encouraging compliance and looking at codes of conduct and working with small- and medium-sized businesses and industries across the country.” The new tribunal A major feature of Bill C-11 is the creation of the Personal Information and Data Protection Tribunal, which will give fines and verdicts following OPC investigations. Per the law, the tribunal will consist of three to six members, put forward by the Minister of Innovation, Science and Industry. One member is required to have experience in information and privacy law. Cavoukian firmly criticized that requirement for one member out of a possible six to be well-versed in the issues that the tribunal will adjudicate. “If you're going to institute this tribunal and they’re going to be able to review the commissioner’s orders, why would you only have one member who needs experience in this area? I would hope that the majority would have that kind of experience.” Israel is also on the same page, suggesting that more specific criteria for experience are needed. “There's other types of requirements that you could put in place there. For example…some tribunals will say at least X years of experience, not just generalized open-ended experience requirement. The other aspect of this is making sure that the public interest is represented as well. So I think I think one thing to consider would be to impose…some limits on industry appointments.” Responding to these concerns, Minister Bains strongly suggested that the tribunal would go beyond the minimum of one member with privacy law experience. “Our goal is to make sure that we have credible, well-respected, well-regarded individuals in the area of privacy and the area of data, and people who understand the adjudication process. And we’re going to make sure that we do the proper outreach to be able to identify top-tier talent to be part of this tribunal,” he said. Beyond the composition of the tribunal, some experts also say there are issues with the base structure of the proposed system, where the OPC and tribunal operate independently of each other, but the tribunal effectively has the final say. Cavoukian says that no other governments use such a structure for data and privacy laws. “I don’t know why they chose the tribunal model, it doesn’t exist anywhere else,” she says. “First you’re giving the commissioner order-making power, which is great, but then you’re stripping him of the authority to actually implement the order making power because it can be challenged at this tribunal. People can go to the tribunal and challenge his orders, which is crazy. It makes no sense at all...if that’s going to be challenged, people have to take it to court.” Israel shares some of those concerns, particularly in terms of the potential effect that the tribunal might have on the Commissioner’s order-making powers. Given the legal structures at play, he says that companies may not be bound by orders as long as an appeal is ongoing. “There's no mechanism for resolving whether compliance should occur on an interim matter while all that appeal process is being resolved.” This ability to have immediate interim or temporary action is particularly important in the realm of data privacy, says Israel. “While things are going through the appeal process or even the investigatory process, the ability to stop something that is deeply problematic and may cause irreparable harm while the issue is being resolved, I think, would be helpful for the privacy commissioner to be able to do.” “If you wait long enough, the remedy itself becomes redundant. Because, it's privacy and the information is out there and it circulates.” Responding to this concern, a spokesperson for Minister Bains indicated in an email that Bill C-11 does grant interim order-making powers to the OPC. “When carrying out an investigation, inquiry, or audit the Commissioner has the power to make any interim order that they consider appropriate...one example would be an interim order for an organization to cease an activity that appears to be in violation of the law.” However, Bill C-11 does indicate that interim orders can still be appealed, and the status of an order during an appeal is left unclear. O’Dell said that he can understand why this might be a flaw, but also that he can understand why the government opted for a separate tribunal. He makes a comparison to criminal law, where in the Canadian federal context, there is a common law tradition of separating investigation from prosecution. “You don't get the investigating police officer deciding, ‘OK, I'm going to prosecute you in the courts’. So there is a distinction between investigation and enforcement on the criminal law side, and that's good practice.” Bains said he agrees with the notion of separating investigation and adjudication, but added that a key rationale for the tribunal was to make the process faster and more approachable than requiring full-scale Federal Court cases. “The objective of this tribunal is to make sure that if there’s an appeal for example that is undertaken by a business, particularly small and medium sized businesses, that it is beneficial for small businesses to go through the tribunal process because it’s less costly and it is done in a more timely manner compared to the Federal Court system.” Class Actions One final enforcement element of Bill C-11 that has received comparatively little attention is that it opens up the possibility for class action lawsuits in situations where the privacy commissioner uncovers a contravention of the CPPA. Under PIPEDA, only individuals who filed (successful) complaints to the OPC could sue for damages. Bill C-11 opens up that option to anybody who is affected by a breach of the new legislation (this would be able to be pursued via Federal Court, or provincial superior courts). This, says O’Dell, is exactly what a data privacy bill should do. “Because data breaches tend to be large in number, although often not necessarily the most serious in terms of each individual, you need a good class action system as well,” he said. And although the proposed new fines drew news headlines when C-11 was announced, major class action lawsuits could have a bigger impact on web giants and other companies handling data. “I think an even bigger headline...will be when we get a big class action where the multiplier effect has a significant topline number,” said O’Dell. That is to say, if a company is found liable for mishandling data for thousands or even millions of people, even a small per-person settlement could add up to an astronomical total. But the exact enforcement provisions — from class actions to fines, or the tribunal — won’t be clear until (or if) Bill C-11 passes. After that, it will be another 12 to 18 months before it takes effect, and it’s at that point that the effects — penalties, orders, and class actions — will become evident. — Reporting by Tim Forster at tforster@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

New privacy legislation mixed bag in terms of enforcement, experts say

News | December 18, 2020

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

New privacy legislation mixed bag in terms of enforcement, experts say

News | December 18, 2020

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Watchdogs find deceptive privacy practices across majority of websites, apps studied

Privacy tribunal unlikely to get through INDU’s look at Bill C-27

Privacy tribunal needed in Digital Charter, ISED continues to tell MPs

Privacy commissioner flags excessive site blocking, privacy risks in age verification bill

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us