What to expect from Canada’s new privacy legislation

November 15, 2020 | By Julius Melnitzer

The feds are tabling new privacy legislation on Monday.

The proposed statutes are the Consumer Privacy Protection Act (CPPA) and the Personal Information and Data Protection Tribunal Act (PIDPTA).

Picture of David Young
Privacy law expert David Young says new privacy laws will feature substantial penalties

Although there’s no concrete information available about the proposed laws’ contents, privacy expert David Young of David Young Law in Ottawa anticipates that the CPPA will replace or substantially revise the Personal Information Protection and Electronic Documents Act (PIPEDA).

“The new legislation could well track many features of the European Union’s General Data Protection Regime [GDPR], including significant financial penalties,” he says.

Young believes that the new framework may resemble Canada’s competition law model, which requires regulators seeking penalties to obtain approval from a quasi-judicial body, the Competition Tribunal. In the case of sanctions under the proposed privacy legislation, that body would be the newly-created Personal Information and Data Protection Tribunal.

If the resemblance holds, however, it’s unlikely that the new regime will unleash a spate of regulatory litigation.

“Recent enforcement experience under the Competition Act is that very few matters are actually argued before the Competition Tribunal,” Young says. “Instead, the Tribunal approves negotiated settlements as consent orders.”

Young also believes that the legislation will create a “Data Commissioner”.

“I don’t know if anyone outside of close government circles has any concrete idea what this role would be or how it would relate to the Office of the Privacy Commissioner [OPC], except that it will seek to regulate the data collection activities of the large internet companies,” Young says. “However, the name of the new tribunal suggests that there may be a ‘data protection’ role separate from privacy.”

If Young is correct, the new legislation should address the criticism that Canada’s privacy laws are laggard on enforcement – so much so that the OPC currently has no power to impose fines or orders.

RELATED ARTICLES

Canada’s privacy regime is a mess

GDPR Impact

Into the Breach: Canada’s data breach notification regulations

Chatbot aids firms’ privacy compliance by tagging clients’ exposure to data breach laws

Pandemic data hubs and contractual, regulatory and ethical risks

Julius Melnitzer is a legal affairs journalist, writing coach and media trainer for lawyers. Readers can reach him at julius@legalwriter.net or at https://legalwriter.net/contact.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Social Media Auto Publish Powered By : XYZScripts.com