Bill to overhaul Canada's privacy laws coming soon

As the number of high-profile online consumer security breaches continues to grow, the federal government is expected to introduce a bill soon toshake up Canada's privacy laws possiblyas earlyas this week.

Innovation Minister Navdeep Bains signalled plans to introduce the legislation late last week on the House of Commons notice paper.

The bill officially called"An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts" would be the first major attempt to changeCanada's privacy law in decades.

Details of the bill won't be available until the legislation is tabled, but a spokesperson forBainspointed to the promises outlined in the minister'smandate letter.

That letter essentially the minister's marching orders from Prime Minister Justin Trudeau tasked himwith drafting a "digital charter" that wouldinclude legislation to give Canadians "appropriate compensation" when their personal data is breached.

It also promisedto introduce newregulations for large digital companies to better protect Canadians'personal data and encourage more competition in the digital marketplace, and to appoint a new data commissioner to oversee those regulations.

"It will be significant and meaningful to make it very clear that privacy is important. Compensation, of course, is one aspect of it,"Bains said back in January, adding that the government also wants "to demonstrate to businesses very clearly that there are going to be significant penalties for non-compliance with the law. That's really my primary goal."

The letter also calls for "enhanced powers for the Privacy Commissioner." The office ofPrivacy CommissionerDanielTherrien who has been calling for more powers said hewill be briefed on the bill after it's tabled.

"Our office has long been calling for federal privacy laws better suited to protecting Canadians in the digital age," said Therrien's spokesperson VitoPilieci.

"Weneed a legal framework that allows for responsible innovation that serves the public interest and is likely to foster trust, but prohibits the use of technology in ways that are incompatible with our rights and values.The law should also provide for enforcement mechanisms that ensure individuals have access to quick and effective remedies for the protection of their privacy rights, and create incentives for broad compliance by organizations."

The 'right to be forgotten'

Earlier this month, a joint investigation by the federal, Alberta and B.C. privacy commissioners concludedthat the real estate company behind some of Canada's most popular shopping centres embedded cameras inside its digital information kiosks at 12 shopping malls in major Canadian citiesto collect millions of images and used facial recognition technology without customers' knowledge or consent.

B.C. Information and Privacy CommissionerMichael McEvoysaid the commissioners likely would have pursued fines against the company, Cadallic Fairview, if they'd had the power.

"Fines in a case like this would have been a consideration. It is an incredible shortcoming of Canadian law," he said.

"We as privacy regulators don't have any authority to levy fines on companies that violate peoples'personal information and that should really change."

Statistics Canada says that about 57 per cent of Canadians online reported experiencing a cyber security incident in 2018.

Bains's mandate letteralso hints at the introduction of a so-called "right to be forgotten" or "right to erasure" law by calling for the "ability to withdraw, remove and erase basic personal data from a platform."

The European Union passed a law back in 2014 allowing citizens to ask Google to remove problematic web hits that pop up when their name is searched, after a Spanish lawyer fought successfully to remove old material about his past debt problems.

Under the EU's law, "inadequate, irrelevant or excessive" web hits aren't deleted, but in most cases Googlehides them from their search results a process known as de-listing or de-indexing.

Conservative MP James Cumming, the party's innovation, science and industry critic, said he'll be reading it closely to make sure it protects Canadians' privacy without being unreasonable for small businesses.

"Canada's Conservatives will always stand up for the privacy of Canadians. When it comes to Liberal legislation, the devil is always in the details," he said in a statement.

"Conservatives will review the legislation to ensure that it protects privacy without imposing burdensome regulations on small businesses who are struggling to keep their doors open during the second wave of the pandemic."