Office of the Privacy Commissioner of Canada Makes Recommendations on Bill C-27

On May 11, 2023, the Office of the Privacy Commissioner of Canada (OPC) announced that the Privacy Commissioner’s written submission on Bill C-27, the Digital Charter Implementation Act, 2022, was published by the House of Commons Standing Committee on Industry and Technology.

Bill C-27 was introduced on June 16, 2022, and proposes to repeal Part 1 of the Personal Information Protection and Electronic Documents Act and enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act, as previously reported by the E-TIPS® Newsletter here.

The Privacy Commissioner shared his intent to promote and implement a vision that recognizes privacy (i) as a fundamental right; (ii) in support of the public interest and Canada’s innovation and competitiveness; and (iii) as an accelerator of Canadians’ trust in their institutions and in their participation as digital citizens. This viewpoint, along with input from interested parties in the space, led the OPC to make the following 15 recommendations on Bill C-27 with the goal to further protect the privacy of Canadians while supporting the digital economy:

1. Recognize privacy as a fundamental right.
2. Protect children’s privacy and the best interests of the child.
3. Limit organizations’ collection, use and disclosure of personal information to specific and explicit purposes that consider the relevant context.
4. Expand the list of violations qualifying for financial penalties to include, at a minimum, appropriate purposes violations.
5. Provide for a right to disposal of personal information even when there is a retention policy in place.
6. Require organizations to build privacy into the design of products and services and carry out privacy impact assessments for high-risk initiatives.
7. Strengthen the framework for de-identified and anonymized information.
8. Upon request, an organization should be required to explain all predictions, recommendations, decisions and profiling made using automated decision systems.
9. Limit the government’s ability to make exceptions to the law through regulations.
10. Where personal information may be disclosed without consent for research purposes, this exception should only apply to scholarly research.
11. Allow individuals to use authorized representatives to help advance their privacy rights.
12. Provide greater flexibility for using voluntary compliance agreements to help resolve matters without the need for more adversarial processes.
13. Make the complaints process more expeditious and economical by streamlining the review of the Commissioner’s decisions.
14. Amend timelines to ensure that the privacy protection regime is accessible and effective.
15. Expand the Commissioner’s ability to collaborate with domestic organizations .

For additional information, the full text of the OPC’s submission on Bill C-27 is available here.

Summary By: Steffi Tran