Privacy watchdog says proposed private sector privacy law ‘a step back’

Privacy Commissioner Daniel Therrien has said the proposed Digital Charter Implementation Act would be a step back for privacy.

The commissioner’s office has published Therrien’s submission on Bill C-11, which is the federal government’s proposed new private sector privacy law.

The submission outlines that the bill would be a step back overall for privacy and “needs significant changes if confidence in the digital economy is to be restored.”

Former Innovation Minister Navdeep Bains introduced the proposed bill in November 2020 and stated that the act will give Canadians increased control over their data and provide transparency about how personal information is handled by companies.

The proposed legislation creates a new Consumer Privacy Protection Act, which removes the electronic documents section of the Personal Information Protection and Electronic Documents Act (PIPEDA).

Therrien says the proposed bill is misaligned and less protective than the laws of other countries. He states that the bill would give consumers less control and organizations more flexibility in monetizing personal data without actually increasing their accountability.

Bill C-11 gives the privacy commissioner order-making powers and the ability to recommend monetary penalties. However, Therrien notes that these are subject to limitations and that only a narrow list of violations would lead to actual penalties. The commissioner outlined that the penalty scheme is “unjustifiably narrow and protracted.”

Therrien’s submission outlines 60 recommendations aimed at ensuring the bill enhances privacy protections for consumers.

“Bill C-11 prioritizes commercial interests over the privacy rights of individuals. While it is possible to protect privacy while giving businesses greater flexibility to innovate responsibly, when there is a conflict, privacy rights should prevail,” the submission reads.

“To that end, the bill should be amended to adopt a rights-based framework that would entrench privacy as a human right and as an essential element for the exercise of other fundamental rights.”

Further, the submission outlines that although Bill C-10 aims to provide greater flexibility to organizations through new exceptions to consent, certain exceptions are too broad to actually promote responsible innovation.

Therrien notes that the best approach to this situation would be to adopt an exception to consent based on actual business interests within a rights-based approach.

“As a society, we must project our values into the laws that regulate the digital space. Our citizens expect nothing less from their public institutions. It is on this condition that confidence in the digital economy, damaged by numerous scandals, will return,” Therrien stated.

Image credit: CPAC