New privacy law gives ‘more weight’ to commercial interests; needs ‘significant changes’: OPC

Following an analysis of Bill C-11, the federal government’s proposed update to the private sector privacy law, the office of the privacy commissioner (OPC) has put forward more than 50 recommendations for the bill which Privacy Commissioner Daniel Therrien said Tuesday would actually be a “step back” for privacy protection as it is currently drafted. During an appearance before the House of Commons Ethics committee Monday, Therrien told MPs there is “no question” that C-11 is a “comprehensive and serious” attempt to address privacy issues, but that it needs significant changes in order to protect individuals, and pledged to share his office’s brief with committee members. In the introduction to the recommendations released Tuesday, Therrien outlines a number of concerns and said C-11 “needs significant changes if confidence in the digital economy is to be restored.” “The Bill arguably gives more weight to commercial interests than the current law by adding new commercial factors to be considered in the balance, without adding any reference to the lessons of the past twenty years on technology’s disruption of rights,” Therrien said Tuesday. “Oddly, the government’s narrative in presenting the Bill, while positive in many respects, focused on the need for ‘certainty’ and ‘flexibility’ for businesses and the need for ‘checks and balances’ on the regulator,” Therrien said. “Unfortunately, it appears this was not a slip of the tongue, as we see that philosophy reflected in several provisions of the Bill.” Therrien said that provisions in C-11 as drafted meant to give people more control actually give them less control because of increased flexibility for organizations to use personal information without consent, and not a corresponding increase in accountability as “one would expect” -- though the OPC is not opposed to some level of flexibility for businesses “within the law.” In its recommendations, the OPC said it “agrees that granting organizations the flexibility to responsibly innovate is essential in a modern, data-driven economy -- and that this will require new exceptions to consent.” It said laws should allow for the use of personal information in the public interest, and that responsible processing of personal information “can serve public goods such as health, economic growth, and better public policies and programs.” Among the OPC's dozens of recommendations is the addition of a preamble to the new Consumer Privacy Protection Act which would “provide guidance as to the values, principles and objectives” that would shape the use of the act, an amended definition of personal information, the inclusion of a definition of sensitive information, and revisions to certain sections that could “introduce a more appropriate weighting of privacy rights and commercial interests.” For example, the OPC recommends that section five of the Consumer Privacy Protection Act’s purpose clause should be amended so as to not refer to privacy rights in a “technical and narrow sense” so it recognizes their “true nature as a quasi-constitutional right.” In its release on the recommendations, the OPC said the bill “omits the requirement under existing law that individuals understand the consequences of what they are consenting to for it to be considered meaningful, and it allows the purposes for which organizations seek consent to be expressed in vague, if not obscure, language.” The OPC also recommends clarified language on topics including informed and meaningful consent by consumers, a 7-day notice period for privacy breaches -- compared to the three months or more it said it takes for it to receive breach reports 40 per cent of the time -- and allowing the regulator, and ultimately the courts, to be able to review organizations’ determinations of whether or not implied consent has been met in certain circumstances, among other revisions. It additionally suggests that record-keeping and reporting requirements be established to deal with disclosure of personal information to government organizations, “especially with respect to disclosures to law enforcement.” Therrien told the Ethics committee Monday that the OPC will be faced with several new responsibilities under Bill C-11, such as reviewing codes of practice and certification programs and advising organizations on their privacy management programs when requested. In order for it to handle its responsibilities, he said OPC “should have the legal discretion to manage its caseload, respond to the requests of organizations and complaints of consumers in the most effective and efficient way possible and reserve a portion of our time for activities we initiate based on our assessment of risks for Canadians.” Under C-11, the OPC would have order-making powers and be able to recommend “very high monetary penalties,” subject to “severe limitations and conditions,” it said Tuesday, including the introduction of an appeals tribunal it said would be unnecessary for accountability and fairness and counter-productive for quick and effective remedies. If the tribunal does end up coming to fruition, the OPC recommends appeals of its decisions go directly to the Federal Court of Appeal and that it be composed of a majority of judges, sitting or retired, with lay members with experience in privacy. Another of OPC’s recommendations is that the act be amended to “prescribe an objective standard for accountability,” such that organizations would have to implement a privacy management program which would include its “policies, practices and procedures” that would ensure compliance with the act. When a breach occurs, the OPC wants to be able to order an organization to “take measures which allow individuals to be compensated for damages suffered, financial or otherwise, stemming from a breach or violation of security safeguards required by law.” The OPC suggests in its release on its recommendations that organizations should be required to undertake privacy impact assessments for new “higher risk” activities, and the law should subject them to proactive audits by the OPC, it said. “This ability to ‘look under the hood’ of these complex technologies and business models, not arbitrarily but based on our expert assessment of privacy risks, and subject to judicial review, is in our view a necessary element of a modern privacy law,” Therrien said in his remarks. In the interest of cooperating with other bodies such as the CRTC, the OPC is also recommending that the act be amended to allow it to enter agreements with the commission and the Competition Bureau so they can collaborate on investigations, inquiries, or other formal compliance matters “which would allow us to collaborate with our Canadian colleagues in the same way we currently collaborate with international data protection authorities.” In order to deal with the “significance and complexity of cross-border data flows,” the OPC recommends clarifying aspects of the act, such as expanding limits on accountability that would mean service providers are not only responsible for customer information transferred to them, but also for information that they collect, use, and disclose on their own account, among other recommendations. The OPC also said it would be reasonable for political parties to be regulated under the act. “Political parties collect significant amounts of information about voters (as well as volunteers, employees, and candidates) and use this data for micro-targeted political campaigning, among other things. These practices have the potential to have significant privacy impacts and, done improperly, threaten trust in the democratic system,” it said. In a statement Tuesday, NDP MP Charlie Angus -- a member of the Ethics committee and NDP critic for Ethics - said the party “welcomes the interpretation on the proposed Bill C-11 from Privacy Commissioner Daniel Therrien.” “The need to update Canada’s privacy laws, particularly in the age of surveillance capitalism, facial recognition and multiple online harm, is clear. But, we are very concerned that the government is using the legislation to undermine the privacy rights of Canadians in order to protect corporate interests,” Angus said. Last March, Angus called for a moratorium on the use of facial recognition tech following reports that the RCMP and several police departments had been using Clearview AI, the purveyor of a facial recognition technology that had its data breached and its entire client list leaked to BuzzFeed News. A set of investigations were launched into the company and the RCMP’s use of its software, with a report on the findings of the latter investigation to be completed in a week or so, Therrien said Monday. - Reporting by Hannah Daley at hdaley@thewirereport.ca and editing by Michael Lee-Murphy at mleemurphy@thewirereport.ca

New privacy law gives ‘more weight’ to commercial interests; needs ‘significant changes’: OPC

News | 05/11/2021 6:22 pm EDT

To keep reading, get a free trial.

Already a Subscriber?

Related Stories

Spam complaints to CRTC on the increase from six months ago

News | 06/05/2023 3:18 pm EDT

CRTC seeks info on international roaming rates

Briefs | 06/05/2023 2:30 pm EDT

Facebook blocking threat “unacceptable”, Rodriguez states

Briefs | 06/02/2023 2:17 pm EDT

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us