Office Of The Privacy Commissioner Of Canada Makes Key Recommendations For Reform Of The Federal Private Sector Privacy Legislation

On May 4, 2022, the Office of the Privacy Commissioner of Canada (OPC) released key recommendations aimed at the development of new legislation to replace the current private sector privacy regime under the Personal Information Protection and Electronic Documents Act (PIPEDA). These recommendations come nearly a year after the OPC published its submissions on the former federal Bill C-11, An Act to Implement the Digital Charter 2020 (as previously reported by the E-TIPS® Newsletter here). The federal government indicated its intention to introduce a new bill, as Bill C-11 died on the order paper due to the 2021 federal election call.

Some of the notable OPC recommendations are grouped into the following general themes:

1. Enabling responsible innovation: The OPC wants to introduce a legitimate commercial interests exception to consent within a rights-based framework and clarify the use of de-identified personal information by organizations. With respect to automated decision making, the OPC feels that the new statute should provide individuals with meaningful rights to an explanation and to contest automated decisions. 
2. Adopting rights-based framework: The OPC maintains that the new statute will recognize both the fundamental right of privacy and the legitimate need of organizations to process personal information for appropriate purposes.
3. Increasing corporate accountability: The OPC feels there is a need to prescribe an objective standard for accountability, specifically an obligation for organizations to implement a privacy management system. Moreover, the OPC recommends prescribing new proactive practices around privacy by design and privacy impact assessments for high-risk activities.  
4. Ensuring interoperability of laws: The OPC notes that the new statute should adopt high privacy standards and not fall behind privacy regimes in other jurisdictions, both domestically and internationally.
5. Adopting quick and effective remedies: The OPC suggests making all violations under the new statute subject to monetary penalties and broadening the list of factors to consider before imposing such penalties to increase transparency. The OPC wants to dispose of the proposed administrative appeal tribunal that was introduced in Bill C-11 to ensure individuals have access to quick remedies. The OPC also recommends rewriting the criminal prosecutions scheme and expanding the private right of action.
6. Providing the OPC tools to adopt a risk-based approach: The OPC suggests that it should have greater discretion with respect to the conduct of compliance investigations; authority to advise organizations on their privacy management programs; and the power to adopt procedural rules for approving codes of practice or certification programs.

The OPC emphasized that its recommendations are aimed at supporting responsible digital innovation within a legal framework that recognizes privacy as a fundamental human right.

Summary By: Anna Troshchynsky