Canada’s recently proposed privacy legislation entitled the Consumer Privacy Protection Act (CPPA) was drafted to better protect Canadian’s privacy and to provide more fulsome control over their data and personal information. Bill C-11, with a default opt-in approach to consent, has been welcomed by industry as a fair and balanced approach to much-needed reform. However, hot off the presses is the Office of the Privacy Commissioner of Canada’s (OPC) response to the Bill which clearly states& the office’s disdain for the CPPA stating that the legislation tips too far to the favour of industry leaving Canadians no better served than they are by PIPEDA. Commissioner Therrien went so far as to say, “the Bill would represent a step back to overall for privacy protection”.
Despite C-11 addressing most privacy concerns that arise in a modern digital economy and promises more control for individuals along with the institution of fines for offenders, the OPC is clear in their view that adequacy with other nations (a major theme for the OPC since the GDPR came into effect in the EU) is still not achieved, leaving Canadians with less protective laws than those in other jurisdictions. Therrien is calling for “greater alignment” and one can only assume he means with the European GDPR.
Therrien’s office is looking for several amendments prior to passing. We have summarized some of the key points here:
A better articulation of the weight of privacy rights and commercial interests.
OPC believes that the current Bill should adopt a rights-based approach, while maintaining the principles-based and not overly prescriptive approach of our private sector privacy law to situate Canada as a leader in privacy. The OPC believes that the Bill as it currently stands, does not adopt a rights-based approach and arguably gives more weight to commercial interests than the current law by adding new commercial factors to be considered in the balance.
Specific rights and obligations.
The overall sentiment of the Commissioner is that the Bill works to provide “certainty and flexibility for businesses, rather than standards and oversight.” – again tipping the balance of power in the favour of industry. He goes on to say that this increased flexibility given to organizations to use personal information without consent does not come with the additional accountability one would expect – an example is where an organization is allowed to rely on implied (opt out) where they establish it appropriate.
He also expresses the need for auditing powers for regulators to routinely “check under the hood” – something that is missing in the current iteration.
Access to quick and effective remedies and the role of the OPC.
Due to limits on the violations subject to administrative penalties, the unnecessary layer (in the view of the OPC) of the Tribunal and an overall lack of resources, consumers would be deprived of quick and effective remedies – “justice delayed is justice denied.”
This Bill is clearly not what the OPC wanted to see, and it will be interesting to see where the chips will fall. One thing is for sure, we need to see this legislation move to Committee where it can be debated and amended to better serve all Canadians.
To read the OPC’s full submission click here.
We encourage you to join us at State of the Nation on May 26th where we will delve further into the subject of privacy in the context of a cookieless ecosystem and review the work IAB Canada is doing to prepare industry for the reality of tighter regulatory constraints.
To join IAB Canada’s Privacy Working Group please reach out to [email protected]