Government files latest attempt at privacy legislation reform

The Liberal government has introduced its second attempt at overhauling the country’s privacy laws covering the business sector.

Innovation Minister François-Philippe Champagne introduced Bill C-27 in the House of Commons this morning. Details of the legislation weren’t immediately available so it wasn’t clear how it will differ from the proposed legislation the government tabled in 2020, but it comes in three parts:

• The Consumer Privacy Protection Act 2022, (CPPA), is the same name as the prior legislation. A government official said that it was essentially the same as the original version, with three minor changes. One is additional protection for children (see further);
• The Personal Information and Data Protection Tribunal, which is the same tribunal that would rule on proposed fines by the federal Privacy Commission for violations of the CPPA,
• and the new Artificial Intelligence and Data Act obliging businesses deploying “high impact” AI technologies to use them responsibly. A commissioner for AI data will enforce the regulations.

UPDATE:The complete legislation can be found here.

UPDATE:An official gives a technical briefing saidThere are five main differences between the CPPA’s older version and the new one.

• Businesses need to have clearer guidelines about what exceptions are permissible for consent to collect personal data.
• Clarification of how businesses must treat this data, including definitions of anonymized and de-identified personal data
• Inclusion of increased responsibilities for firms that collect data on children. Businesses would be restricted in their ability collect and use information about minors. The law would also hold organizations to a higher standard when handling minors’ information than handling the data of adults.
  Minors — or their parents or guardians — would have the right to understand how their personal data is being used, and the right to demand a business delete that data.
• Expanding the discretion of Privacy Commissioner to initiate investigations into possible CPPA violations.

Organizations will need to continue to use plain language to explain to users what personal information is being collected and how it will used.

The changes were made in response to one complaint. They also specified that some members of Personal Information and Data Protection Tribunal must be privacy-law experts.

Champagne was mentioned in a press release. saidThe new proposed CPPA will protect Canadians’ privacy and ensure that innovative businesses have clear rules to follow as technology evolves. This includes:

• increasing control and transparency when Canadians’ personal information is handled by organizations;
• Giving Canadians the freedom and security to transfer their information from one organization into another;
• Canadians can request to have their information deleted when it is no more needed.
• The Privacy Commissioner of Canada is empowered with broad order-making power, including the ability for a company to stop using personal data or collecting it;
• establishing significant fines for non-compliant organizations—with fines of up to five per cent of global revenue or $25 million, whichever is greater, for the most serious offences.

The government says the proposed Artificial Intelligence and Data Act AIDA) will introduce new rules to strengthen Canadians’ trust in the development and deployment of AI systems, including:

• Protecting Canadians by ensuring that high-impact AI systems are designed and deployed in a manner that identifies and assesses the risks of harm or bias and minimizes them.
• Establishing an AI and Data Commissioner to assist the Minister of Innovation, Science and Industry with fulfilling ministerial duties under the Act, including monitoring company compliance, ordering third party audits, and sharing information as appropriate with other regulators and enforcers;
• Providing clear criminal prohibitions and penalties for the illegal use of data for AI development, reckless deployment of AI that causes serious harm, and fraud to cause economic loss by its deployment.

A government official gives a briefing to reporters said AIDA “is a principles-based law that lays out key requirements that companies must follow to demonstrate they are developing and deploying artificial intelligence responsibly.

“The government will define in regulations classes of AI systems that have a high impact on people. Core obligations will require that organizations assess their AI systems against high-impact system criteria. Organizations will be required to document their rationale and proactive identify and mitigate risks when developing and deploying high-impact system. This includes risks to human health, safety and biases in systems.”

They will also be required to provide general information to the public regarding their AI systems.

The legislation addresses concerns that AI systems may be used to discriminate against women, minorities, and people with disabilities.

The proposed laws would only apply to federally-regulated industries, such as the financial, telecom, interprovincial transportation, and interprovincial energy sectors, and provinces and territories that don’t have their own private sector privacy laws. These include Ontario and Manitoba, New Brunswick and Nova Scotia, Newfoundland and Labrador and Prince Edward Island.

The private-sector privacy law reform aims to update the Personal Information Protection and Electronic Documents Act. It must be overhauled to meet the requirements of the European Union. If foreign businesses collect personal data of EU residents, they need legislation or agreements that are largely similar to the EU’s General Data Protection Regulation (GDPR), it needs to be updated.

Former privacy commissioner Daniel Therrien criticized the original CPPA (at the time called Bill C-11) for allowing businesses to collect or use an individual’s personal information without their knowledge or consent under certain circumstances. He also didn’t see the need for a tribunal to examine any proposed penalties. And he complained that the bill didn’t clearly state that Canadian residents have a right to privacy.

C-11 was killed when the government called for the 2021 elections.

The private sector has been pressing the government to keep PIPEDA’s CPPA intact and not make it too similar to the GDPR in the lead-up to its second attempt to overhaul PIPEDA.