New legislation needed to cover growing privacy issues: Therrien

Privacy Commissioner Daniel Therrien is calling for new legislation that would cover consent issues, forbid widespread data collection, hold collectors accountable and permit audits by his office. He laid out these prescriptions in a speech to the International Association of Privacy Professionals (IAPP) on Thursday. “What is needed is not more self-regulation but true regulation, meaning objective and knowable standards adopted democratically, enforced by democratically appointed institutions like my office that can ensure organizations are truly accountable,” he said according to a copy of the speech released by the Office of the Privacy Commissioner (OPC). A new law should reintroduce the knowledge and understanding element of meaningful consent; stipulate that personal information may not be gathered for any purpose by an organization but only for specific purposes; issue an objective standard for accountability to ensure compliance with privacy laws; and authorize the OPC to conduct privacy audits to verify compliance. Therrien had called for the audit authority when the Trudeau government introduced its privacy laws last year. That legislation died on the order paper when the election was called. “Former Bill C-11 would have given consumers even less control over their personal information and organizations more control,” he said. “The knowledge and understanding requirement for meaningful consent would have been weakened.” He also stated the Personal Information Protection and Electronic Documents Act (PIPEDA) has not inspired confidence in consumers. Canadians are overwhelmingly worried about the lack of control over personal data, he added. Canada can learn from other jurisdictions when it comes to privacy protection, the commissioner told the conference. He cited the European Union’s General Data Protection Regulation (GDPR) and laws like South Korea’s which are ahead of Canada’s. He dismissed calls for a made-in-Canada law, saying international standards are needed so Canadian firms can operate globally. “If we learn the lessons of the early years of the digital revolution, we will adopt privacy laws that allow for innovation, sometimes without consent, for legitimate commercial interests and socially beneficial purposes, within a framework that protects our fundamental rights and values,” Therrien said. “This does not mean a carbon copy of the GDPR. There can and should be some adaptations. For instance, fewer recitals. Fewer consent pop-ups.” He reiterated his concerns about actions of the Public Health Agency of Canada (PHAC) which was collecting mobility data in the fight against COVID. The OPC was informed of the matter but not permitted to investigate it. “Although we were informed both by government and an organization of their intent, neither was prepared to give the OPC the detailed information required for us to ‘look under the hood’ and confirm that privacy was indeed respected,” the commissioner noted. Any new legislation should consider six factors in respecting privacy: enable responsible innovation; adopt a rights-based framework; increase corporate accountability; adopt similar principles in public and private sector laws; ensure Canadian laws are interoperable internationally and domestically; and adopt quick and effective remedies, including permitting the OPC to make orders and to impose financial penalties if necessary. Therrien said he was hopeful about the future of privacy in Canada. Citizens are aware that this issue is “not just for geeks or techies”. Provinces are responding to that concern. Quebec has passed new legislation and new laws are under development in British Columbia and Ontario. There is movement in the United States as well, he noted. “Am I hopeful that effective laws will soon be adopted in Canada?,” he asked. “Less than I would like. Resistance to change is stronger than I had anticipated.” He ended his speech by thanking the staff at OPC and congratulating his provincial counterparts for cooperation to ensure the effectiveness of privacy laws. Therrien’s term as privacy commissioner is coming to an end. The government has not yet announced his successor. –Reporting by Paul Park at ppark@thewirereport.ca and editing by Jenna Cocullo at jcocullo@thewirereport.ca.

New legislation needed to cover growing privacy issues: Therrien

News | 05/26/2022 4:07 pm EDT

To keep reading, get a free trial.

Already a Subscriber?

Related Stories

Privacy commission, CRTC among best PS workplaces, survey finds

Briefs | 07/25/2023 4:42 pm EDT

Dufresne pledges to continue Therrien’s work as Privacy Commissioner

News | 06/13/2022 3:54 pm EDT

Philippe Dufresne appointed Privacy Commissioner

People | 06/09/2022 2:19 pm EDT

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us