Submission to the OPC’s Consultation on Consent under PIPEDA (Bernier)

Chantal Bernier (Counsel/Dentons)

October 2016

Note: This submission was contributed by the author to the Office of the Privacy Commissioner of Canada’s Consultation on Consent under PIPEDA.

Disclaimer: The opinions expressed in this document are those of the author(s) and do not necessarily reflect those of the Office of the Privacy Commissioner of Canada. As this submission was provided by an entity not subject to the Official Languages Act, this document has been translated from its original language by the OPC for your convenience. In case of discrepancies, please consult the French version. Information about the OPC’s policy on providing web site content in both Official Languages can be found on the Important Notices page.

---

Summary

My comments center on the following premise: the PIPEDA already creates a consent regime that provides for i) adaptation of various modalities of consent in accordance with circumstances and ii) deviation in exceptional cases. I will therefore not approach the issue as “alternatives to consent,” but as an adaptation of modalities of consent based on circumstances. Practical experience has shown that there are four modalities of consent:

• Broad or specific consent
• Express or implied consent

The choice of modality is guided by section 6.1 of the PIPEDA, which, for consent to be valid, requires that

“an individual to whom the organization’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting.”

All four modalities of consent are therefore valid, provided that the individual understands the scope of the consent. I will approach the four questions submitted for consultation in light of this premise.

Based on my experience with the Office of the Privacy Commissioner of Canada, together with my experience as counsel in the private sector, I think that the validity of online consent arises from the following priorities:

1. Since the very essence of the right to privacy is the right to control the disclosure of our personal information, the notion of “alternatives to consent” or “remplacement du consentement” must be abandoned in favour of the notion of “modalities of consent” or “modalités de consentement.”
2. Modalities of consent—broad or specific, express or implied—vary according to sensitivity of information and reasonable expectations of privacy.
3. The “test” to determine the legitimacy of a modality is as follows: was the individual duly informed, at the time of consent, so as to understand the consequences? As such, increased transparency requirements are a priority.
4. De-identification excludes application of the PIPEDA.

The full submission is available in the following language(s):

French (HTML document)

Note: As this submission was provided by an entity not subject to the Official Languages Act, the full document is only available in the language provided.