New federal privacy legislation must balance privacy rights with commercial interests, says lawyer

Still a work in progress, if the federal government’s new privacy legislation, Bill C-11, properly balances personal privacy rights with the rights of commercial entities to use personal data, Canada could re-emerge as a world leader in privacy, says Wendy Hulton, a senior regulatory lawyer and partner at Dickinson Wright PLLC

Bill C-11, the Digital Charter Implementation Act, was tabled Dec. 2, 2020. The bill would repeal parts of the Personal Information Protection and Electronic Documents Act (PIPEDA) and enact the Consumer Privacy Protection Act to govern the collection, use, and disclosure of personal information for commercial activity. The new Act would also bolster the role of the federal Privacy Commissioner, giving it the authority to conduct inquiries, including the powers to compel the production of records and enter private places.

C-11 also enacts the Personal Information and Data Protection Tribunal Act, creating a Tribunal to hear appeals of Privacy Commissioner orders and apply a new administrative monetary penalty system.

“Canada has been a world leader and I think we've fallen behind,” says Hulton. “I expect that with the new C-11 we will probably become a world leader again in privacy. I think we've got to show that there is a possible way to recognize and respect both privacy rights and the interests of commercial enterprises.”

The European Union’s General Data Protection Regulation and The California Consumer Privacy Act have arguably gone with more of a “rights-based approach,” focussed on individual privacy rights, and many businesses have expressed concerns about the onerousness of those laws, she says.

For commercial enterprises, Canada needs to make privacy rights feasible, provide clarity and require consent in a manner which gives consumers confidence, because businesses have to be able to use personal information and data, says Hulton.

“What Canada I think is going to do with C-11, once it gets it right, is have a better approach to that.”

Hulton’s 30-year practice includes advising clients on Canada’s federal and provincial privacy legislation. Having spent nearly 25 years at Miller Thomson LLP, building a privacy and regulatory practice that was all cross-border, she decided to move it over to Dickinson Wright – a firm with 18 U.S. offices – in 2013.

“C-11 is going back to drawing board in a big way,” she says.

The reason, says Hulton, is the Federal Privacy Commissioner, Daniel Therrien’s, delivery of “a lot of very substantial criticisms” to the House of Commons Standing Committee on Access to Information, Privacy and Ethics back in May.

“I think what he's done is drill down… some of the key aspects of what we need to do to fix Bill C-11 to actually achieve the purposes that it was aimed to do.”

Therrien said, in its current form, C-11 “represents a step back overall for privacy protection.” His suggested changes fall under three themes: “a better articulation of the weight of privacy rights and commercial interests,” “specific rights and obligations” and “access to quick and effective remedies and the role of the OPC.”

C-11 is also “frequently misaligned and less protective” than the privacy laws in other jurisdictions, said Therrien. The bill gives “increased flexibility” to organizations to use personal information without consent but lacks the additional accountability “one would expect,” and administrative penalties would not apply to “the most frequent and important violations:” those related to consent and exceptions to consent, he said.

Therrien also said the OPC would operate “under a system of checks and balances…  that would unnecessarily stand in the way of quick and effective remedies for consumers.”

“What he said, basically – and what I’ve been saying too, is the devils in the details,” says Hulton. “The proposed C-11 just lacks sufficient clarity and transparency in this area, particularly in connection with transborder data flows.”

Therrien commissioned Teresa Scassa, Canada Research Chair in Information Law and Policy at the University of Ottawa, to examine C-11’s treatment of transborder data flows. Scassa produced 13 recommendations. Number five calls on the government to axe the “business activities exception.”

The exception is an example of where Ottawa “missed the mark” in balancing privacy rights with commercial interests, says Hulton. The Privacy Commissioner has previously said that informed consent is required for a business enterprise’s use of personal information. C-11 attempted to carve out an exemption where consent was unnecessary for an activity “in the course of which obtaining the individual consent would be impractical, because the organization does not have a direct relationship with the individual,” she says.

“Well, you know, WTF, right?” says Hulton. “… I don't think that's the way that this should work. And I don't think that's going to enhance consumer confidence in the digital world, which is one of the big concerns that we're facing right now.”