Canada’s Patchwork Privacy Protections are Ready for a Major Update

The digital economy and the pressing need to democratise civil society have forced us to confront anew the role that privacy plays in our lives and law. We live in an era of surveillance capitalism, where our data is a commodity, often traded for goods and services—whether we want it to be or not. What does this new era mean for Canadian privacy law? How well is Canada equipped for this new reality?

Let’s start with a quick primer on Canadian privacy law—it’s more of a quilt than many expect. Whereas individuals’ privacy with respect to the federal government is regulated by the Privacy Act and certain Charter rights, most personal information is instead regulated under the Personal Information Protection and Electronic Documents Act  (‘PIPEDA’). PIPEDA regulates how private sector organizations collect, use and disclose personal information in the course of commercial business. PIPEDA generally applies throughout Canada unless there is a “substantially similar” provincial regime already doing the same job. The net result is that most people in Canada are protected by PIPEDA unless they are covered by the patchwork of substantially similar provincial laws in Québec, BC, and Alberta. There are some loose ends here, such as Ontario’s and New Brunswick’s frameworks for personal health, but they’re smaller pieces of the big Canadian privacy quilt.

So with PIPEDA as the default regime and some provinces using home-sewn solutions, what’s the problem? There are two. The first is that PIPEDA is out of date and has important gaps. Parliament has punted on the task of mending these gaps for years. The second problem is that Canada’s provincial privacy laws are also sorely out of date. BC’s law, for example, has never been substantially amended—despite coming into force before today’s digital economy, surveillance capitalism, and even YouTube. And whereas BC’s law is subject to periodic reviews, the recommendations produced by these reviews are almost never implemented.

There is reason to hope, however. Ontario is in the early stages of consulting on what could be a cutting-edge provincial privacy law. Québec is even further along, with its National Assembly now considering a bill to create one of the most thorough and modern privacy regimes outside of the EU (we’ll discuss that more in our next post in this series). BC may yet adopt changes as a result of this year’s legislative review.

If we’re lucky, Canada will move in the years ahead towards a general recognition of privacy as a human right—codifying privacy’s fundamental role in our democracy and civil society. But there are looming risks on the horizon too, such as the danger posed by falling too far behind the EU’s ultra-modern privacy regime. Our next post in this series will talk about that risk and about what Québec’s new privacy bill might mean in the years ahead.