Gov. tables three-headed private sector privacy reform bill

Touting it as a "historic day" at an afternoon press conference, Innovation Minister François-Philippe Champagne Thursday announced the launch of a suite of privacy reforms aimed at updating Canada's private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). The Digital Charter Implementation Act, also known as Bill C-27, encompasses three proposed acts: the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act. The proposed laws will only address those privacy matters currently governed by PIPEDA in the private sector, as the public sector is governed by the Privacy Act, which Thursday’s announcement does not cover. The bill, Champagne said at the press conference, "will enhance Canadian trust in the digital economy of the 21st century." The Consumer Privacy Protection Act will, according to a press release, increase control and transparency when Canadians' personal information is handled by organizations. Officials from the department of Innovation, Science, and Economic Development – which will oversee enforcement of the bill – said on a briefing call with reporters that the bill will provide "significant additional capacity for individuals to have transparency and understanding to allow for meaningful consent," and features requirements to use plain language in privacy policies, the ability for users to request deletion of collected information, and a ban on the bundling of consent across multiple types data sharing. "If a company is providing me with an application related to their business and then wants to provide that personal information to a third party for some kind of follow on service related to that, they won't be able to bundle that consent with my original sign up to the application," an ISED official said on the call. "It will have to be segmented and segregated to make sure that individuals are aware." The act is a second attempt at privacy law reform, after a 2020 legislative effort died on the order paper when the 2021 federal election was called. That version of the bill came in for heavy criticism from then-Privacy Commissioner Daniel Therrien, who said that while the bill was a "serious" attempt at reform, was ultimately a "step back" for privacy. Like the previous version of the bill, the new attempt gives the Office of the Privacy Commissioner its long-desired order making power, alongside the ability to level administrative monetary penalties of $25 million or five per cent of global revenue on violating companies, whichever figure is higher for serious offenses. According to ISED officials, the bill has been updated to include expanded definitions of deidentified and anonymized data, and a new section relating to the use artificial intelligence. "We read with interest and continue to understand the considerations of the previous privacy commissioner laid out in this area, and we believe this bill addresses them in significant degree," an ISED official said on the briefing call. "In particular, there were other elements in the technical side such as the capacity for the commissioner to be able to have discretion over the usage of their investigatory power while still preserving many or the key elements of a modernized regulator, like order making power and meaningful consequences." This part of the new bill also includes stricter standards for the handling of minors' data, by either limiting the ability of an organization to collect it in the first place or holding organizations to a "higher standard" when handling minors' information. According to ISED officials, the legislation gives children the right to control their data with limited exceptions, the right to have their data safeguarded, the right to understand how their data is being used, and the right to request access to the data. Children can also request the right to have their data deleted. Also included in the package of legislation is the Personal Information and Data Protection Tribunal Act, which will create a new tribunal to enforce the CPPA. The third piece of the bill, the Artificial Intelligence and Data Act will establish a new position of the AI and Data Commissioner to support the innovation minister in audits of companies, compliance, and coordination with other regulators. The new commissioner will also outline "clear criminal prohibitions and penalties regarding the use of data obtained unlawfully for AI development or where the reckless deployment of AI poses serious harm and where there is fraudulent intent to cause substantial economic loss through its deployment," the release said. At the Thursday press conference, Attorney General David Lametti said his department is finalizing the updates to the Privacy Act, the public sector privacy law. "We undertook extensive public consultations last year to obtain the views of Canadians and we continue to engage with Indigenous partners on the modernization initiative. Combined, this feedback is helping to inform our final recommendations to modernize the Privacy Act," Lametti said. — Reporting by Michael Lee-Murphy at mleemurphy@thewirereport.ca and editing by Jenna Cocullo at jcocullo@thewirereport.ca.

Related Stories

OPC appeals court Facebook decision

News | 05/15/2023 3:31 pm EDT

OPC calls for changes to Bill C-27

News | 05/12/2023 12:27 pm EDT

Stakeholders call for a “whole-of-government” approach to competition reform

News | 04/24/2023 5:19 pm EDT

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us