Proposed privacy bill promises transparency for Canadians, hefty fines for organizations

Innovation Minister Navdeep Bains has introduced the proposed Digital Charter Implementation Act to modernize Canadian privacy laws.

Bains noted in a press conference that the act will give Canadians increased control over their data and provide transparency about how personal information is handled by companies.

The new legislation creates a new Consumer Privacy Protection Act, which removes the electronic documents section of the Personal Information Protection and Electronic Documents Act (PIPEDA).

If the bill is passed, companies could face fines of up to five percent of their revenue or $25 million, whichever is greater, for serious offences. Bains stated that this would be the “strongest fines among the G7.”

The act gives the privacy commissioner order-making powers, including the ability to force a company to comply with laws. The act also gives the commissioner the power to order a company to stop collecting data or using personal information.

The commissioner would also have the power to recommend fines for companies that do not comply with the law. It’s worth noting that Privacy Commissioner Daniel Therrien has been asking for these abilities for years, and outlined an urgent need for modernized privacy laws in his annual report released last month.

Under the act, a new Personal Information and Data Protection Tribunal will be created to levy these fines and hear appeals of the orders.

Bains outlined that the legislation will give Canadians the freedom to move their information from one organization to another in a secure manner. It also aims to ensure that Canadians have the ability to demand that their information be destroyed when it’s no longer needed.

He also stated that the legislation will ensure that when Canadians go online, consent requirements they’re presented with will be provided in plain simple language, and not in long or confusing legal language. 

The minister also stated that the act will be beneficial for businesses, and that they will be allowed to ask the privacy commissioner to approve practices and certification systems. He noted that the legislation provides a clear framework for organizations and will help them pursue “responsible innovation.”

Further, the act would allow businesses to disclose de-identified data to public entities under certain circumstances for “socially beneficial purposes.” This point is beginning to raise concerns from Canadian advocacy groups.

The Public Interest Advocacy Centre says it is “aghast that the federal government feels it can weaken consumer privacy with a doublespeak bill that removes a consumer’s right to protect his or her personal information that is used for any ‘business activity’ if it is ‘de-identified’ or used for what the government deems is a ‘socially beneficial purpose’.”

The Canadian Registration Authority (CIRA) has praised the bill and stated that “companies that handle massive troves of personal data must be held accountable for protecting that data, be transparent about how they use it, and face real consequences should they break the trust of their users.”

Bains has stated that the legislation will help Canadians embrace the new digital world amid the COVID-19 pandemic where many services are being brought online.

“For Canada to succeed, and for our companies to be able to innovate in this new reality, we need a system founded on trust with clear rules and enforcement. This legislation represents an important step towards achieving this goal,” Bains stated in a news release.

The act introduced today essentially puts into action the tasks outlined in Bains’ mandate letter given by Prime Minister Justin Trudeau, in which he was tasked with drafting a digital charter.

The government has outlined that this proposed act is an “initial step” towards a comprehensive reform of Canada’s privacy framework. It’s also proposing to modernize the Privacy Act, which applies to the federal public sector.

Image credit: @navdeepbains