Canada Introduces New Federal Privacy Bill

On November 17, the Canadian government drafted new privacy legislation that would make significant changes to their existing federal privacy laws. If passed, Bill C-11, the Digital Charter Implementation Act (DCIA), would replace Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA) with the Consumer Privacy Protection Act (CPPA).

Want to compare Canada’s data privacy laws side-by-side? Check out our Privacy Laws Comparison Table

As a reference PIPEDA was Canada’s first privacy law and the anchor for what is now referred to as CASL (Canadian Anti-Spam Legislation).

The DCIA is aligned closely with the EU’s GDPR and remains focused on PIPEDA and its 10 privacy principles. DCIA provides individuals with more control over how their personal information is collected, used and disclosed by businesses for commercial/marketing purposes.

CPPA has suggested several important changes to Canada’s existing privacy laws. Here are a few highlights of the proposed law:

• A privacy management program provided to the Office of the Privacy
• Commissioner on demand
• Fines of up to 5% or $25 million
• Private right of action
• A comprehensive standard for appropriate processing of personal information
• Defines activities for processing personal information without consent
• Defines when transfers to service providers does not require knowledge and consent
• Defines circumstances in which de-identified information can be processed
• Requires an explanation of the logic behind automated decision-making about a person
• Requires disclosure of how the personal information used to make predictions, recommendations or decision was obtained
• Expands consumer rights to include portability and deletion
• Creates codes of practice and certification programs to facilitate compliance

Bill C-11 (DCIA) still has a very long road to travel before it becomes law and many of the details haven’t been specified yet. The federal legislative process in Canada tends to move very slowly. CASL for example, took over 2 years to be finalized. The introduction of this law, and its alignment with GDPR reinforces the message that consumer privacy and privacy legislation are top of mind with legislators around the world. Building and maintaining a privacy-forward program for your company is essential.

We’ll continue to keep you updated on how this proposed law evolves over the coming months.