Privacy Reform: Back to the Drawing Board For C-11?

Fasken | Jennifer Stoddart, Daniel Fabiano and Christopher Fergerson | Jun 9, 2021

On May 27, 2021, Prime Minister Trudeau reappointed Federal Privacy Commissioner Daniel Therrien for another year – and in doing so, sent a signal about the future of the government’s efforts to modernize the Personal Information Protection and Electronic Documents Act (PIPEDA). This announcement came just after the Commissioner delivered a hard-hitting speech to privacy professionals at the annual meeting of the Canadian chapter of the International Association of Privacy Professionals (IAPP) on May 26, 2021. In his speech, Commissioner Therrien strongly rejected Bill C-11, the bill to reform PIPEDA and give effect to a previously proposed Digital Charter. This sequence of events suggests the government may be willing to make significant alterations to its  privacy modernization initiative for the private sector.

The following text is a summary of the highlights of the Commissioner’s speech as delivered.^[1]

Criticisms and alternatives for regulating the private sector

The Commissioner’s comments in this speech were not focused on the details of Bill C-11 but refer to what he calls the guiding principles of current data protection as now enshrined in the legislation of many other jurisdictions. He asserts that giving due consideration to these principles would result in a much more satisfactory Canadian law that is aligned with international standards. His speech focused on five  “fundamental issues” that must be addressed in privacy law reform.

The values of data, privacy and the consent model

Bill C-11 maintains consent as the heart of Canada’s private sector privacy law.  While the Commissioner acknowledges the difficulties in balancing a consent standard against the need to use data in modern technological innovation, he disagrees with how Bill C-11 strikes this balance – notably by creating new exceptions to consent when obtaining consent is too difficult or impractical.

See:  How Verifiable Digital Identity Will Protect Your Post-Pandemic Privacy

In the Commissioner’s view, consent has its place, but over-reliance on consent can authorize objectively unreasonable activities contrary to our values; and in other circumstances, an individual’s refusal to provide consent can be a disservice to the public interest.  During this “fourth industrial revolution”, data-driven innovation and socio-economic development require alternatives to an exclusively consent-based model.  In the Commissioner’s view, a new privacy law should accommodate new, unforeseen but responsible uses of personal information in society’s interest or for legitimate commercial interests, within a rights-based framework, and subject to regulatory oversight.  This would allow the use of personal information for purposes unforeseen at the time of collection, so long as the purposes fit within a framework of democratic values and personal rights.

A rights-based framework for privacy regulation

Many have dismissed the introduction of human rights values as an impossibility in context of the division of powers within Canada, given that PIPEDA rests on the federal trade and commerce power. But analysing recent Supreme Court decisions, the Commissioner points out how the addition of a preamble has been highlighted by the Court for its interpretive force in deciding how given legislation might fit into the constitutional division of powers.

In the Commissioner’s view, a rewrite of Bill C-11 could add a preamble clearly situating the law within the scope of commercial activities but also adding that the commercial regulatory purpose would be achieved by following the rules set out in the proposed law. The Commissioner suggests these rules should promote the lawful, fair, proportional, transparent and accountable collection, use and disclosure of personal information that (among other things) recognize the fundamental right of privacy of individuals.

See:  6 lessons on online privacy and digital authentication

The recent discussion paper published by the Department of Justice on Privacy Act (the federal public-sector privacy law) reform is a much more satisfactory approach in this regard, according to the Commissioner. In a future update to the Privacy Act, the Commissioner states, the government proposes adding a purpose clause to a new version of the act stating that one of the key objectives of the legislation is protecting human dignity, personal autonomy and self-determination.

The data protection challenges of public-private partnerships and contracting

The Commissioner noted that the increased use of public-private projects has highlighted, often through data misuse or data breaches, the challenges of operating within two set of rules, one for the private sector (PIPEDA) and one for the public sector (the Privacy Act). For example, government may collect personal information from individuals for public health reasons, and may use platforms and other services provided by the private sector to do so.  This may result in those private sector entities accessing and using sensitive personal information for their own purposes without the appropriate consent. For example, the RCMP’s use of Clearview AI technology, which the Office of the Privacy Commissioner recently investigated, is a striking example of the public sector sharing personal information with the private sector in questionable circumstances, according to Commissioner Therrien.

He also notes that Privacy Act reform discussions have also highlighted the importance of demonstrating accountability, quick remedies for privacy violations and imposing a “reasonably required” standard for personal information collection that also refers to concepts of proportionality and necessity. These elements are lacking from Bill C-11.

Continue to the full article –> here

---

The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada’s Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

FFCON21 ON-DEMAND VIDEOS NOW AVAILABLE! Support NCFA by Following us on Twitter! Follow @NCFACanada

Source: https://ncfacanada.org/privacy-reform-back-to-the-drawing-board-for-c-11/