Feds propose new privacy law
Stiff fines promised for tech giants that break rules designed to protect Canadians’ personal data,
OTTAWA—The federal government is proposing a new privacy law to give Canadians’ greater control over how companies collect and exploit their personal information and data, and promising stiff fines for companies that break them.
Under the proposed legislation, Canadians would have the right to demand companies delete their personal data if they no longer consent to its use, and require companies to be transparent about how that data is used.
It would also allow Canadians to request their data be transferred from one company or institution, such as a bank, to another.
The Consumer Privacy Protection Act (CPPA) is the first major overhaul of Canada’s private sector privacy laws in decades, and mirrors some of the aspects of the European Union’s digital privacy laws, which are seen as the world standard.
It would also give the federal privacy watchdog long-sought powers to order companies to comply with Canada’s privacy laws and to co-operate with investigations and audits. Those that do not could be fined up to $25 million or five per cent of their global gross revenues, whichever is higher — a potentially significant bill for global internet and tech giants like Facebook, Google and Amazon.
When the current privacy regime was introduced, “social media wasn’t prevalent, the internet of things was not prevalent,” Innovation, Science and Industry Minister Navdeep Bains said in an interview. “Because technology has evolved to a large degree over the past number of years, it was important to update and modernize our privacy, and the fundamental premise that we were pursuing when it comes to Canadians
feeling empowered was having more control over their data.”
The Liberals are billing the legislation as a way to enshrine into law the principles of a “digital charter” outlined by Prime Minister Justin Trudeau in 2019. The charter laid out principles that companies participating in the digital economy would be expected to follow.
But Bains suggested more reforms aimed at large tech and internet companies are coming, including a promised tax on multinational companies operating in Canada on their sales of online advertising and profits from Canadian user data.
The CPPA would not just apply to multinational tech giants, but also to smaller companies that are struggling to migrate heir businesses online during the COVID-19 pandemic.
Bains said there will be a long lead time for small businesses to prepare for the new rules, should the CPPA be approved by Parliament.
“We’ve also allowed (businesses) to develop codes of conduct and work with the privacy commissioner to do that, because we do still have a principles-based approach,” Bains said.
“The principles-based approach allows us to make changes to the regulations when appropriate,” he said, pointing to recently rules around reporting privacy breaches.
The approach shows the “flexibility we have to keep up with technology evolving and changing,” Bains said.
François Joli-Coeur, a lawyer with firm BLG who specializes in cybersecurity and privacy issues, said the big change from a business perspective isn’t so much but the the compliance privacy commissioner’s requiremm new enforcement powers and the creation of a data protection tribunal with the ability to impose fines.
The new compliance requirements largely codify what businesses have already been encouraged to do, Joli-Coeur said, but the privacy commissioner’s ability to issue orders is “something new and something significant.”
Jim Balsillie, the former BlackBerry executive and founder of the Centre for Digital Rights, said the CPPA is a “step in the right direction,” but encouraged the government to go farther by clearly recognizing that “privacy is a fundamental human right.”
“For example, the bill falls far short on its proposals to ensure responsible innovation by seemingly limiting its regulation of (artificial intelligence) to algorithmic transparency,” Balsillie wrote in a statement to the Star.