Home

Insights

Canadian Data Privacy Law…

Services

Insights

People

About

Canadian Data Privacy Laws Are Changing. Is Your Business Ready to Keep Up?
DOWNLOAD PDF

Walter, Carly J. Hulton, Wendy G.

November 2020

Industry Alerts

Introduction

On November 17, 2020, Canada’s federal government introduced a bill to enact new legislation that would strengthen protections for individuals from privacy loss due to the failures and limitations of corporate consumer privacy measures. The proposed legislation, known as the Consumer Privacy Protection Act (“CPPA”), would be the first major overhaul of Canada’s privacy law rules on the private sector since the Personal Information Protection and Electronic Documents Act (“PIPEDA”) came into force in April 2000.

If the CPPA passes into law, it will replace the PIPEDA, currently the leading federal privacy law governing federally-regulated corporations and private sector companies in Canadian provinces and territories that do not have their own privacy legislation. The bill to enact the proposed legislation, including the CPPA, is at first reading. The next step would be for it to go to second reading and then to a committee for further review and recommendation, before ultimately receiving royal assent and passing into law.

Key Changes Proposed to Canada’s Consumer Privacy Framework

The CPPA proposes several key changes to Canada’s corporate consumer privacy rules

First, the CPPA imposes administrative penalties of up to 3% of global revenue or $10 million CAD for non-compliant organizations. In addition, the CPPA expands the range of privacy-related offences; penalties for certain offences under the CPPA subject non-compliant organizations to a maximum fine of 5% of global revenue or $25 million CAD.

Second, the CPPA creates the Personal Information and Data Protection Tribunal (the “Tribunal”). The Tribunal is empowered to issue penalties and fines under the CPPA upon recommendations from the Office of the Privacy Commissioner of Canada (the “Commissioner”). The Tribunal will also adjudicate appeals from the Commissioner’s orders.

Third, the CPPA broadens the order-making powers of the Commissioner. Under the CPPA, the Commissioner may order an organization to:

Take measures to comply with the CPPA;

Stop doing something that is in contravention of the CPPA;

Comply with the terms of a compliance agreement that has been entered into by the organization; or

Make public any measures taken or proposed to be taken to correct the policies, practices, or procedures that the organization has put in place to fulfil its obligations under the CPPA.

Furthermore, as mentioned above, the Commissioner may recommend that the Tribunal issue a fine or penalty on an organization for violating certain provisions in the CPPA.

Fourth, the CPPA clarifies the rules for valid consent to data sharing. To obtain valid consent under the CPPA, an organization must provide individuals with certain information before the individual can consent to having his or her data collected. Specifically, the information that organizations must provide includes the purpose(s) of the collection, use, and disclosure, the “reasonably foreseeable consequences of the collection, use or disclosure,” the types of personal information involved, and the “names of any third parties or types of third parties to which the organization may disclose the personal information. ” Implied consent will be acceptable in certain circumstances, taking into account the individual’s reasonable expectations and the sensitivity of the personal information.

Fifth, the CPPA enhances consumers’ control over the personal information organizations collect. Under the CPPA, individuals are allowed to request disposal of their personal information, and individuals are allowed to withdraw consent to the use of their information. Individuals will also be granted data mobility rights, namely the ability to transfer their personal information from one organization to another. However, it should be noted that in certain circumstances organizations will be allowed to use de-identified information without an individual’s consent. For example, the CPPA would allow organizations to disclose de-identified data to public entities in certain circumstances for “socially beneficial purposes.”

Sixth, the CPPA introduces new transparency rules for “automated decision systems” (aka algorithms) organizations employ “to make predictions, recommendations or decisions about individuals that could have significant impacts on them.” The provisions provide individuals the right to request that organizations explain how a prediction, recommendation, or decision was made by an automated decision-making system and explain how the information was obtained.

Global Considerations

If the CPPA passes into law, Canada would be following many other jurisdictions that have strengthened and updated their privacy laws in recent years, including the European Union.

In 2018, the European Union implemented the General Data Protection Regulation (the “GDPR”) to strengthen and modernize its corporate consumer privacy regulations. The rules and regulations contained in the GDPR inspired many of the recommendations in the House of Commons Standing Committee on Access to Information, Privacy and Ethics’ 2018 report entitled Towards Privacy by Design: Review of the Personal Information Protection and Electronic Documents Act (the “Report”). In turn, the Report influenced many of the new rules and regulations for corporate consumer privacy measures in the CPPA.

The GDPR’s influence on the CPPA is also relevant to the extent that the CPPA would harmonize between the corporate consumer privacy rules in the European Union and Canada. Since the European Union implemented the GDPR in April 2018, Canadian companies have faced legal obstacles to doing business in the European Union. The GDPR imposes strict rules on corporate consumer privacy measures, and until now, most Canadian companies’ consumer privacy measures coincided with the comparatively lower standards in the PIPEDA. By bringing their measures in line with the CPPA, Canadian companies doing business in the European Union would likely avoid many of the legal obstacles posed by the GDPR’s standards.

Impact on Provincial Legislation

The impact of a new federal legal framework for assessing corporate consumer privacy measures on provincial data privacy legislation remains unclear at this point. In fact, many provinces are currently in the process of revising their own rules regarding consumer data privacy. Quebec has introduced Bill 64, which brings its private sector privacy law close to the GDPR. Ontario has conducted consultations to establish privacy sector privacy protection laws that might be stronger than the PIPEDA, while British Columbia has started a review on improving its private sector privacy law.

Steps Organizations Should be Taking Now

While companies can expect a transition period to bring their practices in line with the new legislation, we recommend companies take the following steps:

Affirm the company’s commitment to ensuring consumer data privacy by reminding employees that data should not be misused under any circumstances, and emphasize that current privacy measures should be taken seriously;

Organize a team to review the current state of the company’s consumer data collection practices and privacy measures;

Identify where current practices and measures may be falling short of current statutory requirements, and where improvements can be made to enhance consumer data privacy and reduce the risks of data privacy breaches;

Develop a plan to rectify any non-compliance with current statutory requirements and improve current practices and measures;

Implement rectification and improvement plans; and

Prepare current procedures for additional changes by regularly monitoring and periodically revising consumer data collection practices and privacy measures.

Conclusion

Private sector companies in Canada should pay close attention to changes to the draft legislation as it moves through Parliament. Though it remains to be seen which aspects of the draft legislation will be adopted, what is clear is that Canadian privacy law is changing, and most companies will find it necessary to change their consumer data collection practices and enhance privacy measures in light of the stricter requirements and stiffer penalties included in the CPPA.

Related Practices

International

Data Privacy and Cybersecurity

Contacts

Wendy Hulton
Partner Toronto

T:416-777-4035

E:[email-masked]

Carly Walter
Associate Toronto

T:416-646-6877

E:[email-masked]

Recent Insights

Industry Alerts While the Nation Focused on the Presidential Race, California Expanded Its Privacy Laws and “Yes” Non-California Businesses Are Likely Impacted

Industry Alerts CETA: A New Opportunity, and Challenge, for Canadian Companies

February 2, 2021Webinars CUSBA Presents 9th Annual Cross-Border Economic Forecast

September 23, 2020Industry Alerts DW China Trade Update (35th Edition) | 迪克森律所中国团队简报 (第三十五期)

September 2020Blogs米国移民局の予算危機と米国移民制度への潜在的影響 | The USCIS Budget Crisis and Its Potential Impact on the U.S. Immigration System

August 19, 2020Webinars Strategies for Easing Non-Essential Travel Restrictions at the Canada-US Border

August 2020Industry AlertsタイムリーにEADカードが発行がされないためI-9を完了できないことについての米国移民局(USCIS)の対応 | USCIS Accommodation on I-9 Completion Due to its Inability to Issue Timely EAD Cards

July 9, 2020Webinars Preparing for USMCA Day: Episode VI - Environmental Considerations and the Path Forward to a “Living” USMCA

July 8, 2020Webinars Vietnam and the Great Supply Chain Realignment

See All Insights

Share

Have a question or want to connect?

Midwest

Ann Arbor

Chicago

Columbus

Detroit

Grand Rapids

Lansing

Saginaw

Troy

South

Ft. Lauderdale

Lexington

Nashville

Washington D.C.

Southwest

Austin

El Paso

Las Vegas

Phoenix

Reno

Silicon Valley

Canada

Toronto

Serving

China 中国

Japan 日本

India इंडिया

Careers

Disclaimer

Privacy Policy

OWA

Invoice Payment

©Copyright 2021 Dickinson Wright PLLC. Dickinson Wright PLLC is a Professional Limited Liability Company registered in the United States.

©Copyright 2021 Dickinson Wright LLP. Dickinson Wright LLP is a Limited Liability Partnership registered in Ontario, Canada. All Rights Reserved.