PIPEDA opposition bill ‘positive’ though unlikely to pass, experts say

A private members bill that would give more power to Canada’s privacy commissioner and require private sector companies to report data security breaches is a positive piece of legislation though it is unlikely to become law, experts say. NDP MP Charmaine Borg’s private members bill C-475 would amend the Personal Information Protection and Electronic Documents Act (PIPEDA) to require companies to report to the privacy commissioner any breach of consumers’ personal information that could result in “harm” to an individual. It would also give the privacy commissioner the ability to fine companies that do not comply with orders from the privacy office. Privacy lawyer Tamara Hunter, with Davis LLP in Vancouver, said in a phone interview that C-475 is a good bill though she does not expect it to pass because it was put forward by an NDP MP. Governments in power rarely support opposition party private members’ bills, though they can. The Conservative government supported an NDP bill on sports betting, Bill C-290. “In some ways, it’s going to be hard for the federal government to argue that there’s anything wrong with this bill,” Hunter said. Under the bill, companies would be required to report to the federal privacy commissioner any data breach of personal information that “a reasonable person” could believe would cause a “possible risk of harm to an individual.” In a March 7 post on Davis LLP's law bulletin, Hunter said the bill would give the commissioner the power to require companies to notify individuals affected by security breaches and to take any company that defies such an order to federal court. The courts could impose a fine of up to $500,000 as well as compensation for punitive damages, she said. Introduced in the House of Commons on Feb. 26, Bill C-475 was scheduled for debate at second reading on Tuesday, though it fell to the bottom of the order paper after Borg was not present to move the motion due to unforseen circumstances, according to her office. Borg said in a phone interview Friday that she now expects the bill to come up for second reading on May 23, and that it's a non-partisan issue. “Privacy protection is something that I think concerns all MPs of the House, not just their political stripes,” Borg said, adding the House of Commons privacy and ethics committee recently studied social media and privacy. “I think there’s a great deal of interest and there’s a great deal of willingness for politicians and for MPs of all stripes to work together to make this go forward,” she said. Chris Parsons, a network expert and doctoral candidate at the University of Victoria, said in a phone interview that the bill would give the privacy commissioner more power to determine whether a company has failed to adequately secure individuals’ personal data. It would give the commissioner the power to impose fines for the first time, he said. “That’s helpful because, currently, those are powers outside of the commissioner’s ability,” Parsons said. “They can issue orders and, in theory, bring someone to a Federal Court, but there isn’t a fine-making power within the commissioner.” Privacy lawyer Éloise Gratton, a partner at McMillan LLP in Montreal, said in a phone interview that the bill would be more effective at holding companies responsible for security breaches and could serve as a deterrent to lax security measures. “If have to come clean and disclose security breaches, they’re going to put more money and resources in prevention and making sure that these breaches don’t happen,” she said. Gratton said the mandatory notifications would benefit individuals notified of a breach. They could take steps to protect their personal information like more closely monitoring their bank accounts or credit card information. She said Alberta is the only jurisdiction in Canada that now requires companies to notify individuals if they have been affected by a security breach. “There’s a few things I can do to make sure that I’m protected,” Gratton said. “That’s the whole reason behind having these security breach notifications mandatory.” Gratton said C-475’s expansion of the privacy commissioner’s powers to issue findings and penalties would make a “major difference” to the office’s powers and could help silence some of PIPEDA’s critics. She said PIPEDA has been criticized for being an “ombudsman model” that gives the commissioner the ability to issue a finding without punishment. “This bill will make sure that the privacy commissioner has some type of power to issue findings and penalties,” she said. “That’s a major difference from the current powers that they have.” Scott Hutchinson, manager of external communications for the Office of the Privacy Commissioner, said in an emailed statement to The Wire Report Monday that the bill is being examined by the office, and that it is happy to see Parliament discussing reforms. “The private members bill speaks to a number of issues that the Commissioner has been publicly raising for some time,” he said. Parsons said the bill is “really positive" though it is “not as comprehensive as it could be.” He said it would not apply to government departments and agencies, and that enforcing the bill could be a problem if companies involved in security breaches are outside of Canada. “As long as they can establish a real and substantial connection to Canada, the federal courts have said, ‘Yes, the commissioner can reach there,’” he said. “But practically, it isn’t always clear that the commissioner will have the resourcing to follow through and actually impose fines or order-making powers.” Parsons said the bill would benefit Canadian individuals and companies by “raising the bar” on Canadian privacy law and harmonizing privacy regulation across provinces, a move that could lead to savings for some companies. He said C-475 would also be helpful to define what types of harm can be caused by security breaches. Among other things, the bill says, harm can include bodily harm, financial loss, identify theft or identity fraud, job loss, humiliation, damaged relationships or reputation, or negative effects on credit ratings. “I think this is an effort by a member of Parliament to start crafting language around what constitutes harm what constitutes risk, in a way that’s more comprehensive than what may always be constituted by the courts,” Parsons said. Hunter said organizations could face more civil claims related to data security breaches if Bill C-475 passes because individuals would be more aware of any loss of their personal information. “It might increase the number of situations where organizations notify individuals about information security breaches and then that in turn, could increase the possibility of the organization being sued by individuals for damages that might arise from that,” she said. Alexandra Fortier, a spokeswoman for Industry Minister Christian Paradis, did not say whether the government will support the bill. In an emailed statement Friday, Fortier said that through government privacy Bill C-12, "we have also proposed amendments to our privacy laws to enhance consumer confidence in the online marketplace," adding that C-12 was based on the recommendations from the House committee that reviewed the act. "If the opposition is ready to get to work we can send this legislation to committee immediately," she said. "I urge the opposition to join us, pass this bill and help protect Canadian consumers and businesses." Parsons said in a previous interview that, under Bill C-12, “it’ll be permissible for Internet service providers to share information about subscribers and it will reduce the potential liability they may face for sharing that information." Bill C-12 remains at first reading in the House. —With reporting by Danika Grenier at dgrenier@thewirereport.ca and editing by Nicholas Kyonka at nkyonka@thewirereport.ca

PIPEDA opposition bill ‘positive’ though unlikely to pass, experts say

Broadcast | April 26, 2013

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us