Did We Get The Privacy Law We Need?

Canada has a new privacy legislation on the table, and it’s a buffet, but time will tell if the dishes on the table come together to make a feast.

Bill C-11, at 119 pages, will significantly reform the privacy landscape. The Digital Charter Implementation Act, 2020 creates a new Consumer Privacy Protection Act (CPPA), and a new Personal Information and Data Protection Tribunal which will be the body to administer penalties and review orders made by the federal Privacy Commissioner (who will have such powers for the first time).

It will take some time to dive into it and see if any of the recommendations CCLA and other privacy-engaged groups have made during a decade or more of consultations have ended up in the legislation in meaningful ways. As is evident from its title, the Digital Charter, first introduced in May 2019, with its focus on control, consent, competition, enforcement and accountability clearly informed the approach taken to this legislation. But don’t let the word “Charter” fool you, this Act does not specifically recognise privacy as the fundamental human right it is, which is a disappointment.

But a quick look reveals the following new highlights, some that seem positive, some requiring closer examination :

• Algorithmic transparency provisions give people the right to know when how predictions or decisions were made about them using AI
• Data portability provisions mean that people can transfer their information from one organization to another
• De-identified data provisions allow sharing between businesses to governments in some ‘socially beneficial’ circumstances
• Consent won’t be required when people should reasonably expect their information to be used for business purposes
• BUT consent provisions must be in plain language, understandable rather than opaque, and when consent is withdrawn, people can ask that their information be deleted
• Big changes to enforcement, with order making powers for the OPC, and large financial penalties for non-compliance up to 5% of global revenue or $25 million for serious offences
• A new private right of action, allowing individuals to sue in cases where a finding of a privacy violation is upheld by the new Tribunal.

The Bill seems to attempt to create a new foundation for a trusted and trustworthy information environment for people across Canada. Whether that foundation is solid or missing some building blocks will emerge over the next hours and days as we analyse what it says in depth. But privacy reform in Canada has begun in earnest, after years of waiting, and there’s work to do to ensure that at the end of the process we get a law that respects privacy rights and provides meaningful protections for all people as we live our digitally-mediated lives.