The Prime Minister’s December 2019 mandate letters to the Minister of Innovation, Science and Industry, the Minister of Justice and to the Minister of Canadian Heritage send out a strong message that major modifications to the rules governing online activity for both organizations and individuals are in sight.
Notably, the mandate letters to the three Ministers contain identical paragraphs about working together to create significant changes to the rules around personal data, literally, "a new set of online rights". The Ministers are also asked to collaborate in advancing the Digital Charter, published by Innovation Canada in May 2019, and in the creation of enhanced powers for the Privacy Commissioner.
A New Set of Online Rights for Individuals
According to the mandate letters, these new rights will include:
- Data portability;
- The ability for a person to withdraw, remove and erase basic personal data from a platform;
- The knowledge of how personal data is being used, including with a national advertising registry;
- The ability to withdraw consent for the sharing or sale of data;
- The ability to review and challenge the amount of personal data that a company or government has collected;
- Proactive security requirements;
- The ability to be informed when personal data is breached with appropriate compensation; and
- The ability to be free from online discrimination including bias and harassment.
Large Digital Companies
The letters to the Ministers of Innovation and of Canadian Heritage charge them both to set up a new framework for major players in the digital space.
They are asked to come up "with new regulations for large digital companies to better protect people’s personal data and to encourage greater competition in the digital marketplace. A newly created Data Commissioner will oversee those regulations".
Social Media Platforms
The Minister of Canadian Heritage is specifically tasked with creating new regulations for social media platforms. These should start with "a requirement that all platforms remove illegal content, including hate speech, within 24 hours or face significant penalties. This should include other online harms such as radicalization, incitement to violence, exploitation of children, or creation or distribution of terrorist propaganda".
There is no deadline attached to the completion of these mandates. However, the implication of the Minister of Justice in implementing the principles of the Digital Charter suggests that legislation may be drafted soon, especially while the clock is ticking towards the deadline of renewing Canada’s adequacy status in the eyes of the European Union.
Adequacy status allows personal data from the EU to be exported freely to Canada. First recognized in 2001, Canada’s adequacy status is due for revision by the EU authorities. Adequacy status facilitates international trade by reducing the regulatory overhead necessary for international data transmission.
The four-year deadline granted under the General Data Protection Regulation (GDPR), adopted in 2016, will expire in May 2020. But if Canada can show that it is revising its legal framework to meet EU standards, a temporary adequacy status may be negotiated while the reforms are put in place. This is why we may see draft regulations and draft changes to the Personal Information and Protection of Personal Information Act (PIPEDA) as soon as the spring of 2020.
With the GDPR in the background as a yardstick, and the principles of Canada's Digital Charter, organizations need to plan for the coming changes which will entail more and careful attention to how they manage data within their organizations and how they respond to new customer demands. With heightened enforcement powers, the Privacy Commissioner will have a greater presence in the marketplace, especially as he will be joined by a new regulatory presence in the person of a Data Commissioner. Organizations should monitor and participate in public consultation and other anticipated engagement opportunities to make their views known to government and to help shape the future of privacy law in Canada. We will be publishing further on this topic as it develops.