Changes to Canadian privacy legislation

Canada’s Privacy Act¹ is more than 35 years old and is long overdue for an update. Given the technological shifts and societal changes over the years, the Government of Canada has committed to reviewing public sector privacy law. After engaging with various experts and stakeholders, numerous changes to the Act are expected to be made in 2021, adding to Canada’s privacy law overhaul.  

The Privacy Act is a key piece of Canada’s overall legal framework for protecting privacy. It focuses on protecting personal information held by the federal government and federal-public section interests. The Privacy Act applies to approximately 265 government institutions, including federal agencies, departments, offices, national counsels, agents of parliament, and more.² It sets out the basic framework for how federal institutions collect, use, retain, and disclose an individual’s personal information. For example, the Privacy Act applies when you leave or enter Canada at a border, when you seek a government service, and when you pay your taxes.

What could a modernized Privacy Act look like?

Through a modernized Privacy Act, the Government is aiming to lay the foundation for Canadians’ trust in how the government treats their personal information. Such modernization could set out an ethical framework that would guide the government on how to responsibly manage personal information and would play an important part in Canada’s digital transformation with better digitally enabled services where personal information is protected. The government is taking into account the principles and rules of data protection laws in other jurisdictions, and is aiming to place the Privacy Act in a position for it to be part of a broader and more modern data protection network, such as Europe’s Global Data Protection Regulation. This modernized legislation could allow the government to develop individualized and contextually sensitive approaches to compliance using a range of technologies.³

The Department of Justice recently held online public consultation, and feedback received during the consultation will be published in an online report. Stay tuned for further updates!

Other recent updates to Canada’s privacy laws

Since 2001, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) has set out the federal rules for how organizations engaged in commercial activities must handle personal information. This legislation applies to all private-sector organizations that collect, use or disclose personal information in the course of commercial activities in Canada. 

Innovation, Science and Economic Development Canada is currently undertaking a review of PIPEDA as part of its digital and data transformation vision. On Nov. 17, 2020, Navdeep Bains – the minister of innovation, science and industry – introduced Bill C-11, entitled the Digital Charter Implementation Act, 2020 (the “Digital Charter”).⁴ Part 1 of the Digital Charter enacts the Consumer Privacy Protection Act (“CPPA”), which in turn repeals Part 1 of PIPEDA.

Bill C-11 was introduced to modernize and strengthen Canadian private-sector privacy law by enhancing transparency and control over personal information held by businesses. Under the CPPA, the federal privacy commissioner has broad order-making powers, including the authority to force an organization to comply with requirements under the CPPA and the authority to order a company to stop collecting data or using personal information. This legislation would also impose new sanctions for non-compliance.⁵

The CPPA’s legislative foundation is anchored by five core pillars:

1. Providing plain-language information that consumers can fully understand and meaningfully consent to the ways in which their data will, or will not, be used;
2. Providing consumers with the ability to transfer their private data between multiple private entities;
3. Providing consumers with the ability to withdraw their consent on the use of their data and to have their personal information properly and permanently disposed of;
4. Providing increased algorithmic transparency, with an emphasis on systems that rely on artificial intelligence or automated decision-making; and
5. Providing consumers with the ability to remove their personally identifiable information in certain circumstances.⁶

Without a doubt, the COVID-19 pandemic has changed the digital world – a large number of Canadians are working from home and connecting with their loved ones from a distance. In light of this, changes to privacy legislation are crucial. Minister Bains noted that this change is “more important than ever,” and as “Canadians increasingly rely on technology we need a system where they know how their data is used and where they have control over how it is handled.”⁷

With these changes, corporations will need to review their privacy policies to ensure compliance with the legislative framework to avoid privacy breaches and possible sanctions. 

The foregoing information provides only an overview of changes to Canadian privacy legislation. Specific legal advice should be obtained. If you have questions in the above regard, please contact Brianna Mayes at (613) 566-2840 or bmayes@perlaw.ca.

Brianna Mayes is an associate in the Business Law Group at Perley-Robertson, Hill & McDougall. Mayes’s business law expertise involves general corporate law and securities, as well as commercial law matters. Mayes also assists clients with the preparation of their wills and powers of attorney. 

^{1 RSC, 1985, c P-21.}

^{2 Government of Canada, “Modernizing Canada’s Privacy Act – Learn more about the Privacy Act” (8 December 2020), online: <https://www.justice.gc.ca/eng/csj-sjc/pa-lprp/res.html#s1>}

^{3 Government of Canada, “Modernizing Canada’s Privacy Act” (5 January 2021), online: <https://www.justice.gc.ca/eng/csj-sjc/pa-lprp/modern.html>.} 

^{4 Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts, 2nd Sess, 43rd Parl, 2020 (first reading 17 November 2020).}

^{5 BLG, “Canada’s Consumer Privacy Protection Act: Impact for businesses” (18 November 2020), online: <https://www.blg.com/en/insights/2020/11/canadas-consumer-privacy-protection-act-impact-for-businesses>}

^{6 David C O’Hair, Andrew I Kimmel, and Arsen Kourinian, “Canada Introduces the Consumer Protection Act” (10 December 2020), online: <https://www.mondaq.com/canada/privacy-protection/1014896/canada-introduces-the-consumer-privacy-protection-act>.}

^{7 Innovation, Science and Economic Development Canada, “New proposed law to better protect Canadians’ privacy and increase their control over their data and personal information” (17 November 2020), online: Government of Canada < https://www.canada.ca/en/innovation-science-economic-development/news/2020/11/new-proposed-law-to-better-protect-canadians-privacy-and-increase-their-control-over-their-data-and-personal-information.html>}