Consultation on consent under the Personal Information Protection and Electronic Documents Act
Learn more about the various initiatives undertaken by the Office of the Privacy Commissioner to consult Canadians on how to improve the current consent model under the Personal Information Protection and Electronic Documents Act (PIPEDA).
On this page
Why we are consulting on consent: Some background information
In May 2015, we identified four strategic privacy priorities to guide our proactive work for the next five years:
- Economics of personal information;
- Government surveillance;
- Reputation and privacy; and
- The body as information.
Under the Economics of personal information priority, we committed to enhancing the consent model under PIPEDA to address concerns raised by individuals and organizations.
What we have done
2016 dialogue on consent and privacy under PIPEDA
In May 2016, we launched a consultation on the issue of consent under PIPEDA. The goal of the consultation was to identify improvements to the current consent model and bring clearer definition to the roles and responsibilities of the various players who could implement them.
We published a discussion paper and asked organizations, individuals, academics, advocacy groups, IT specialists, educators and other interested parties for their comments:
- Consent and privacy: A discussion paper exploring potential enhancements to consent under PIPEDA (May 2016)
What we heard
We received 51 written submissions in response to the paper, with roughly half coming from businesses or associations representing businesses. We also held five stakeholder roundtables across the country and solicited the views of individual Canadians through focus groups held in four Canadian cities.
- Overview of consent submissions (October 2016)
- Submissions received for the consultation on consent (October 2016)
- Public opinion survey: Qualitative public opinion research with Canadians on consent—Final report (March 2017)
Our results and recommendations
On September 21, 2017, we published the results of our 2016 consultation. The report outlined recommendations to address consent challenges posed by the digital age and indicates actions we will take.
- Report on consent in the 2016-2017 Annual Report to Parliament on the Personal Information Protection and Electronic Documents Act and the Privacy Act (September 2017)
In this consultation report, we urged provincial and territorial governments to integrate privacy education in school curricula in order to ensure that the next generation of Canadians is well informed of their privacy rights. In addition, in November 2017, we published a letter to the Council of Ministers of Education, along with our provincial and territorial counterparts, to address the critical importance of privacy education.
- News release: Make privacy education a greater priority in curricula, privacy guardians urge (November 2017)
- Joint letter to the Council of Ministers of Education calling for privacy education to become a greater priority (November 2017)
2017 consent guidance consultations
In the report on the results of our 2016 consultation, we committed to updating key guidance on online consent and to develop new guidance that would specify areas where collection, use and disclosure of personal information is prohibited, such as situations that are known or likely to cause significant harm to individual.
In September 2017, we solicited feedback on two draft guidance documents:
- Draft guidelines: Obtaining meaningful online consent
- Draft guidance: Inappropriate data practices—Interpretation and application of subsection 5(3)
Individuals, organizations, other privacy enforcement authorities, academics, advocacy groups, information technologists, educators, students and other interested parties had until December 4, 2017 to contribute their views on the recommendations in these draft guidance documents.
What we heard
A total of 13 submissions were received:
- two from individuals
- one from a private-sector organization
- and ten from associations representing private-sector organizations
In the call for comments, we indicated that submissions would not be posted on this website. However, we have compiled a commentary document to describe the themes and comments received, along with explanations why certain changes were, or were not, made to the final versions:
Our results and recommendations
On May 24, 2018, we published two important new guidance documents to help organizations ensure they comply with their privacy obligations in the digital age:
- News release: Privacy Commissioner issues new guidance to help address consent challenges in the digital age
- Guidelines for obtaining meaningful consent, which was issued jointly with the offices of the Information and Privacy Commissioners in Alberta and British Columbia (Note: Our Office will begin to apply these guidelines on January 1, 2019)
- Guidance on inappropriate data practices: Interpretation and application of subsection 5(3) (Note: Our Office will begin to apply this guidance on July 1, 2018)
Next steps
Although we published the new guidance documents on May 24, 2018, please note that we will only begin applying the new Guidelines on obtaining meaningful consent on January 1, 2019 and the new Guidance on inappropriate data practice on July 1, 2018.
- Date modified: