On May 27, 2021, Prime Minister Trudeau reappointed Federal Privacy Commissioner Daniel Therrien for another year – and in doing so, sent a signal about the future of the government’s efforts to modernize the Personal Information Protection and Electronic Documents Act (PIPEDA). This announcement came just after the Commissioner delivered a hard-hitting speech to privacy professionals at the annual meeting of the Canadian chapter of the International Association of Privacy Professionals (IAPP) on May 26, 2021. In his speech, Commissioner Therrien strongly rejected Bill C-11, the bill to reform PIPEDA and give effect to a previously proposed Digital Charter. This sequence of events suggests the government may be willing to make significant alterations to its privacy modernization initiative for the private sector.
The following text is a summary of the highlights of the Commissioner’s speech as delivered.
Criticisms and alternatives for regulating the private sector
The Commissioner’s comments in this speech were not focused on the details of Bill C-11 but refer to what he calls the guiding principles of current data protection as now enshrined in the legislation of many other jurisdictions. He asserts that giving due consideration to these principles would result in a much more satisfactory Canadian law that is aligned with international standards. His speech focused on five “fundamental issues” that must be addressed in privacy law reform.
The values of data, privacy and the consent model
Bill C-11 maintains consent as the heart of Canada’s private sector privacy law. While the Commissioner acknowledges the difficulties in balancing a consent standard against the need to use data in modern technological innovation, he disagrees with how Bill C-11 strikes this balance – notably by creating new exceptions to consent when obtaining consent is too difficult or impractical. In the Commissioner’s view, consent has its place, but over-reliance on consent can authorize objectively unreasonable activities contrary to our values; and in other circumstances, an individual’s refusal to provide consent can be a disservice to the public interest. During this “fourth industrial revolution”, data-driven innovation and socio-economic development require alternatives to an exclusively consent-based model. In the Commissioner’s view, a new privacy law should accommodate new, unforeseen but responsible uses of personal information in society’s interest or for legitimate commercial interests, within a rights-based framework, and subject to regulatory oversight. This would allow the use of personal information for purposes unforeseen at the time of collection, so long as the purposes fit within a framework of democratic values and personal rights.
A rights-based framework for privacy regulation
Many have dismissed the introduction of human rights values as an impossibility in context of the division of powers within Canada, given that PIPEDA rests on the federal trade and commerce power. But analysing recent Supreme Court decisions, the Commissioner points out how the addition of a preamble has been highlighted by the Court for its interpretive force in deciding how given legislation might fit into the constitutional division of powers.
In the Commissioner’s view, a rewrite of Bill C-11 could add a preamble clearly situating the law within the scope of commercial activities but also adding that the commercial regulatory purpose would be achieved by following the rules set out in the proposed law. The Commissioner suggests these rules should promote the lawful, fair, proportional, transparent and accountable collection, use and disclosure of personal information that (among other things) recognize the fundamental right of privacy of individuals.
The recent discussion paper published by the Department of Justice on Privacy Act (the federal public-sector privacy law) reform is a much more satisfactory approach in this regard, according to the Commissioner. In a future update to the Privacy Act, the Commissioner states, the government proposes adding a purpose clause to a new version of the act stating that one of the key objectives of the legislation is protecting human dignity, personal autonomy and self-determination.
The data protection challenges of public-private partnerships and contracting
The Commissioner noted that the increased use of public-private projects has highlighted, often through data misuse or data breaches, the challenges of operating within two set of rules, one for the private sector (PIPEDA) and one for the public sector (the Privacy Act). For example, government may collect personal information from individuals for public health reasons, and may use platforms and other services provided by the private sector to do so. This may result in those private sector entities accessing and using sensitive personal information for their own purposes without the appropriate consent. For example, the RCMP’s use of Clearview AI technology, which the Office of the Privacy Commissioner recently investigated, is a striking example of the public sector sharing personal information with the private sector in questionable circumstances, according to Commissioner Therrien.
He also notes that Privacy Act reform discussions have also highlighted the importance of demonstrating accountability, quick remedies for privacy violations and imposing a “reasonably required” standard for personal information collection that also refers to concepts of proportionality and necessity. These elements are lacking from Bill C-11.
Domestic and international interoperability
The Commissioner, highlighting the importance of Canada’s desire to maintain its adequacy status under the European Union’s General Data Protection Regulation, points out that interoperability for data flows is desirable for both domestic and international situations. It reduces compliance costs, increases competitiveness, and assures citizens that their personal information will be similarly protected when it leaves Canada. All Canadian jurisdictions should strive to be substantially similar he stated, regretting Quebec’s Bill 64’s interjurisdictional restrictions (including interprovincial restrictions) while praising its more rights-based approach – as demonstrated in the individual’s right to protect her reputation.
Penalties, the role of the Office of the Privacy Commissioner and transparency
Some of Commissioner Therrien’s most direct criticisms are aimed at the proposed new administrative regime in Bill C-11. He labels the penal provisions hollow and decries the number of privacy violations not subject to any sanction (Bill C-11’s penalty provisions are limited to violations of specific sections of the proposed law, which notably do not include violations of all consent rules or the principle of accountability).
He also criticizes the slower decision-making process inherent in the proposed new Personal Information and Data Protection Tribunal, and its impacts on access to justice for consumers. He notes that this two level enforcement structure does not exist in a similar form anywhere else in the world, and advocates instead for the Commissioner to have the power to issue orders and impose administrative penalties, with appeals instead going directly to the courts.
In calling for this change, he affirms that the Office of the Privacy Commissioner is ready to develop fair processes and rules of practice for imposing orders and penalties directly (and without oversight by an administrative tribunal) and also to demonstrate transparency and accountability for its actions under any new legislation.
The Commissioner’s Conclusion
Referring to the array of Canadian allies and trading partners who have privacy legislation along the lines of what he is proposing, he points out that many of them have the same proportion of small and medium businesses in their economy as Canada (e.g. the UK, Australia) and that strong data protection legislation does not seem to hinder innovation in many countries (e.g. Germany, South Korea). Both Canadian public and private sector laws need meaningful change, and the Commissioner remains optimistic that this will happen.
The Commissioner’s speech was deliberate, appearing to be extensively researched and carefully laid out. It draws from recent Canadian jurisprudence and policy work which makes it more compelling for legislators and government decision makers considering the changes that could be brought to private sector privacy regulation.
Indeed, the speech appears to be a condensed version of the very detailed 70-page submission made to the Standing Committee on Access to Information, Privacy and Ethics (ETHI) of the House of Commons in mid-May, edited to make a more direct statement. This Parliamentary submission has not yet received much commentary but warrants more attention by those interested in data protection reform in Canada, as it appears that Commissioner Therrien is committed to advancing the views set out in that written submission.
Significantly, Minister of Innovation, Science and Industry François-Philippe Champagne has stated that he is open to making modifications to Bill C-11.
Given Commissioner Therrien’s term extension and the Minister’s statement, the autumn of 2021 may very well bring a new draft of privacy legislation or, at the least, a significant reform of the current Bill C-11 proposals.
 Available at https://iapp.org/news/video/keynote-iapp-canada-privacy-symposium-2021-annual-commissioners-address/ at the time publication. It is likely that the final text, in both official languages, will soon be published on the website of the Office of the Privacy Commissioner of Canada (priv.gc.ca).
 Alex Boutilier, 2021-05-31, Industry minister open to “improvements” in privacy law that watchdog panned, Toronto Star, https://www.thestar.com/politics/federal/2021/05/31/industry-minister-open-to-improvements-in-privacy-law-that-watchdog-panned.html