Privacy Act Reform
Lead Directorate: Policy, Research and Parliamentary Affairs Directorate
- At the request of the Department of Justice (DOJ), the OPC provided a submission on Privacy Act reform in December 2019.
- In November 2020, DOJ launched a public consultation on proposals for reform of the Privacy Act (Respect, Accountability, Adaptability: A discussion paper on the modernization of the Privacy Act). The OPC is generally encouraged by DOJ’s comprehensive proposals for reform, which it found represented significant strides toward a law that aligns with modern data protection norms.
- Specific proposals that the OPC supports include:
- Adding a purpose clause to the Privacy Act specifying that one of the key objectives of the legislation is “protecting individuals’ human dignity, personal autonomy, and self-determination”, thereby recognizing the broad scope of privacy as a human right;
- Measures aimed at providing meaningful oversight and quick and effective remedies, such as order-making and expanded rights of recourse to Federal Court;
- An expanded definition of “personal information”;
- Explicit requirements for protection of information; and
- Mandatory breach reporting to affected individuals and the Privacy Commissioner.
- The OPC provided DOJ with a submission in response in March 2021 (Public Consultation on Modernization of the Privacy Act: Submission of the Office of the Privacy Commissioner of Canada to the Minister of Justice and Attorney General of Canada). The OPC made a number of recommendations to DOJ that it felt important for ensuring effective regulation in the digital environment, including provisions for:
- Regulating AI;
- Strengthening the collection threshold;
- Refining the proposed definition for publicly available personal information; and
- Expanding proposed order-making powers for the OPC beyond complaints on refusals of access to personal information.
- The Minister of Justice’s December 2021 mandate letter instructed the Minister to continue substantive review of the Privacy Act, including engagement with Indigenous partners to develop specific proposals for amendments to the Act. This review is to build on previous public consultations and technical engagements amongst experts.
- As it stands today, there is no bill in Parliament and there is no ongoing formal, specific dialogue between the OPC and DOJ on Privacy Act reform.
- The OPC provided DOJ with a preliminary forecast of the resources needed by the OPC to implement the measures included in DOJ’s discussion paper. The forecasted resources accounted for the fact that many of the proposed measures represented new mandated obligations for the OPC, including enhanced oversight powers and a mandated role in providing proactive guidance and privacy advice.
- In anticipation of the continuation of the DOJ privacy review or bill, the OPC is currently preparing a more comprehensive costing estimate based on detailed assessment of the measures proposed.
- When a bill is eventually introduced, the Policy, Research and Parliamentary Affairs Directorate and Legal Services will prepare analysis and recommendations, and the Policy, Research and Parliamentary Affairs Directorate’s Parliamentary Affairs team will prepare for an appearance before the relevant parliamentary committee.
Personal Information Protection and Electronic Documents Act Reform
Lead Directorate: Policy, Research and Parliamentary Affairs Directorate
- The OPC is mandated to provide oversight for the Personal Information Protection and Electronic Documents Act (PIPEDA). As part of its responsibilities, the OPC provides advice to Parliament on proposed amendments to PIPEDA. The OPC believes the law needs urgent updates to protect Canadians’ privacy in today’s data-driven economy.
- The Minister of Innovation, Science and Economic Development (ISED) is responsible for PIPEDA, including making regulations and introducing amendments.
- PIPEDA is subject to a recurring five-year statutory review by Parliament, with the most recent review in 2017. The most recent significant amendment to PIPEDA was in 2015 when the Digital Privacy Act received Royal Assent, introducing new provisions related to breach reporting. See: The Digital Privacy Act and PIPEDA.
- In November 2020, the Government of Canada introduced Bill C-11, the Digital Charter Implementation Act, 2020 which would have repealed Part 1 of PIPEDA and enacted the Consumer Privacy Protection Act (CPPA) and the Personal Information and Data Protection Tribunal Act.
- The OPC’s view of Bill C-11 was that it would be a step back overall for privacy. For example, the Bill would not have provided for quick and effective remedies for individuals or a recognition of privacy as a human right.
- Bill C-11 would have expanded the OPC’s mandate and imposed on it new responsibilities, including requiring the Commissioner to undertake certain activities on demand, regardless of work volumes. It would not have provided the OPC with the legal discretion to allocate its resources to areas of greatest impact and risk.
- The OPC provided a submission to Parliament outlining its recommended changes to Bill C-11 in May 2021 (Submission of the Office of the Privacy Commissioner of Canada on Bill C-11, the Digital Charter Implementation Act, 2020), in which it noted that the CPPA was less protective than laws in other jurisdictions and would have given consumers less control over their personal information. It also conveyed concerns that the CPPA would not have provided the OPC with the flexible tools needed to achieve its mandate.
- Bill C-11 died on the order paper on August 15, 2021 when the 44th General Election was called. The Minister of ISED has publicly stated that the Government of Canada will introduce an amended private sector privacy law in 2022, however the OPC has no information on the timing of a new bill.
- ISED has publicly stated that a new bill will include adjustments to selected provisions in the former Bill C-11. While the OPC is aware that new measures to protect the personal information of children will be included, ISED has not provided any details on the contents of a new bill.
- Commissioner Therrien has met with the Minister of ISED and with Deputy Minister Simon Kennedy to encourage the adoption of our recommendations, most recently in March 2022. The OPC has also held several working level meetings with ISED officials to provide additional information regarding our recommended amendments to the Bill.
- In May 2022, Commissioner Therrien issued a statement on the urgent need to modernize Canada’s privacy laws in response to the House of Commons Standing Committee on Access to Information, Privacy, and Ethics’ (ETHI) report on the Collection and Use of Mobility Data by the Government of Canada. In support, the OPC also provided ETHI with:
- Key OPC recommendations for a new federal private sector privacy law; and
- A legal opinion by Addario Law LLP on the constitutional validity of Bill C-11 and amendments proposed by the OPC (The Constitutional Validity of Bill C-11, the Digital Charter Implementation Act).
- The measures proposed in C-11 would have brought important changes to OPC mandate, shifting from its ombuds role to an enforcement model. The OPC estimates this would have required a doubling of our full-time equivalent resources (employees).
- The OPC has prepared and recently shared with ISED a comprehensive costing estimate of the measures proposed in C-11. The estimate assumes no change to what was in the bill, though does provide comparative figures for a case where the OPC received broad discretion in handling complaints and requests by organizations for advice.
- Once a new bill is introduced, the OPC will review its proposed measures and make recommendations for subsequent OPC submissions and Parliamentary appearances.
- Once a bill is passed, the OPC will develop positions to provide recommendations for proposed regulations that the government may introduce pursuant to the amended legislation.
- Statement from the Privacy Commissioner following release of ETHI report into the government’s collection and use of mobility data
- Presentation to Minister Champagne on legislative reform, March 2022.
- 2020-2021 OPC Annual Report to Parliament, Legislative reform: for effective privacy protection, responsible innovation and strengthened consumer trust
- Innovation, Science and Economic Development Canada, Canada’s Digital Charter: Trust in a digital world
- Innovation, Science and Economic Development Canada, Proposals to modernize the Personal Information Protection and Electronic Documents Act
Recent Provincial Law Reform Developments
Lead Directorate: Policy, Research and Parliamentary Affairs Directorate
- On September 22, 2021, Quebec enacted Bill 64, which modernized Quebec’s privacy laws.
- Commissioner Therrien appeared before the Quebec Parliament on September 24, 2020, and supported Quebec’s efforts, stating they are “leading the way” in privacy reform (Appearance before the Committee on Institutions of the National Assembly of Quebec regarding Bill 64, An Act to modernize legislative provisions as regards the protection of personal information).
- British Columbia (BC):
- On December 6, 2021, the BC Special Committee to review the Personal Information Protection Act (PIPA) released a report on modernizing PIPA.
- Commissioner Therrien appeared before the Committee on June 22, 2021, supporting recommendations made by the BC Office of the Information and Privacy Commissioner (BC OIPC) and voicing the OPC’s views on elements for PIPEDA reform (Statement before the Special Committee to review BC’s Personal Information Protection Act).
- The OPC also made a written submission on July 30, 2020 in support (Letter from Commissioner Therrien to the Special Committee to Review the Personal Information Protection Act).
- On June 17, 2021, Ontario released a White Paper outlining a proposal for a general private-sector privacy law.
- On September 7, 2021, the Information and Privacy Commissioner (IPC) of Ontario issued a statement that was supportive of the White Paper (IPC Comments on the Ontario Government’s White Paper on Modernizing Privacy in Ontario).
- Quebec: Provisions of Quebec’s Bill 64 will come into force over a three-year period, beginning in September 2022, with the majority coming into force in September 2023.
- BC: [Redacted]
- Ontario: The OPC awaits to see Ontario’s priorities regarding private sector privacy legislation following the provincial election of June 2, 2022.
- With provinces leading in privacy law reform, there is a risk that federal legislation will fall behind, creating a patchwork of privacy laws across the country. Governments should strive for interoperability as it helps to ensure that privacy rights are similarly protected across provincial borders, and it reduces compliance costs for businesses.
- All three provincial efforts include provisions that support the OPC’s recommendations for federal private-sector law reform, including taking a rights-based approach to privacy, and increased enforcement powers for the regulator, among others.
- Ontario’s White Paper criticized Bill C-11, stating it “stripped away key protections”. In the OPC’s 2020-2021 Annual Report to Parliament, it noted that Ontario’s proposals include more effective remedies than those found in Bill C-11, specifically, for the Ontario IPC to issue penalties directly rather than the tribunal model provided for in Bill C-11.
- The Policy, Research and Parliamentary Affairs Directorate will continue to monitor and engage with the OPC’s provincial counterparts on privacy reform in their jurisdictions, including analyzing and preparing briefing materials on significant developments.
- If bills are introduced in British Columbia or Ontario, the OPC may be invited or choose to make further submissions or appearances before provincial legislatures.
- Briefing Note, Overview of Amendments to Quebec’s Privacy Law, June 25, 2020.
- Note de breffage, Amendements au projet de loi n°64, 28 octobre 2021.
- Commission d’accès à l’information du Québec, Tout savoir en continu sur la modernisation des lois sur la protection des renseignements personnels au Québec (only in French).
- British Columbia:
- Briefing Note, Special Committee Report on Modernizing British Columbia’s Private Sector Privacy Law, March 1, 2022.
- Briefing Note, Summary of Ontario White Paper: Modernizing Privacy in Ontario, June 18, 2021.
Law Reform Transition Preparatory Work
Lead Directorate: Director of Law Reform Transition
- In June 2021, the OPC initiated transition work to prepare for an expanded mandate following the Government of Canada’s proposals to reform the federal privacy laws, as reflected in Bill C-11 and in the Department of Justice’s public consultation on the modernization of the Privacy Act.
- A Transition Task Force (TTF) consisting of representatives from all sectors was set up to carry out this work in two phases:
- Conceptualization Phase (June to October 2021), with the view to proposing a way forward for transitioning the OPC to its expected expanded roles; and
- Implementation Phase (October 2021 onwards), aimed at executing senior management decisions and preparing for any necessary structural modifications.
- During the Conceptualization Phase, the TTF delivered on the:
- Identification of the key responsibilities that the OPC could reasonably expect from the reform of the Privacy Act and of PIPEDA;
- Research and benchmarking consultations with other jurisdictions and regulatory bodies with somewhat equal or similar functions;
- Production of analysis papers on each of the new or expanded responsibilities, including workload assumptions, the professional groups that would carry out the different tasks, how to integrate these functions at OPC, and to some extent, the structural changes that might be needed to incorporate these new or expanded functions; and
- Identification of actions that could be put in place in the short, medium and long term in order to prepare the OPC for its expanded roles.
- The ongoing Implementation Phase focuses on the materialization of the changes. The following assessments have been completed:
- Identification of possible tasks, process steps, resources, impacts, input and output of each of the new and expanded function;
- Determination of the competencies and classification required for OPC employees; and
- A comprehensive costing estimate of the measures envisaged in C-11 to complement the rough estimate provided to Innovation, Science and Economic Development Canada (ISED) on short notice in November 2019. The updated costing estimate was shared with ISED in April 2022.
- The Director of Law Reform Transition continues to lead efforts across the office. This includes the completion of the ongoing reassessment of the initial forecasted cost of the measures included in the Department of Justice (DOJ) discussion paper, in light of recent research and benchmarking exercise and feedback received from Commissioner Therrien on the first draft of the reassessment, in anticipation of a bill or the continuation of the DOJ consultation.
- The OPC plans to explore the reallocation of resources and reassignment of employees according to priorities related to law reform.
- The OPC will also develop plans to initiate the implementation of short-term and pre-law reform measures as unknown factors become clearer, including the allocation of funds and the adoption of legislation and its coming into force.
- The Government of Canada will likely make changes to the former Bill C-11 and to the measures envisaged in the DOJ Consultation Paper, which will impact costing.
- The OPC has little to no details on what changes are being envisioned to either proposal but is prepared to confirm or quickly adjust costing once further measures or details are known.
- The OPC’s ability to immediately move forward with the implementation of some of the short-term and pre-law reform measures identified hinges on the clarity of the current funding pressure situation and operational context of the OPC.
- The OPC plans to commence a conversation with relevant private-sector stakeholders (“Engage to Engage”) on its guidance and advisory activities, and on procedural safeguard rules related to adjudicative powers, in the interest of transparency and in building trust and confidence in our efforts to maintain high standards of privacy protection for Canadians. For further reading see Engage to Engage proposals.
- The Director of Law Reform Transition is working with Human Resources on issues related to the competencies, skills, classification, courses of interest, statement of merit criteria and other preliminary steps to prepare current staff for law reform, and to prepare the OPC for the hiring and onboarding of new staff.
- As of October 15, and for a two-year term, the Director of Law Reform Transition position has been expanded to include Change Management, with a mandate to oversee OPC’s preparation for any organizational changes that may be necessary as part of the OPC’s growth. This includes structure, governance and management of the organization.
- Date modified: