November 15, 2020 | By Julius Melnitzer
The feds are tabling new privacy legislation on Monday.
The proposed statutes are the Consumer Privacy Protection Act (CPPA) and the Personal Information and Data Protection Tribunal Act (PIDPTA).
Although there’s no concrete information available about the proposed laws’ contents, privacy expert David Young of David Young Law in Ottawa anticipates that the CPPA will replace or substantially revise the Personal Information Protection and Electronic Documents Act (PIPEDA).
“The new legislation could well track many features of the European Union’s General Data Protection Regime [GDPR], including significant financial penalties,” he says.
Young believes that the new framework may resemble Canada’s competition law model, which requires regulators seeking penalties to obtain approval from a quasi-judicial body, the Competition Tribunal. In the case of sanctions under the proposed privacy legislation, that body would be the newly-created Personal Information and Data Protection Tribunal.
If the resemblance holds, however, it’s unlikely that the new regime will unleash a spate of regulatory litigation.
“Recent enforcement experience under the Competition Act is that very few matters are actually argued before the Competition Tribunal,” Young says. “Instead, the Tribunal approves negotiated settlements as consent orders.”
Young also believes that the legislation will create a “Data Commissioner”.
“I don’t know if anyone outside of close government circles has any concrete idea what this role would be or how it would relate to the Office of the Privacy Commissioner [OPC], except that it will seek to regulate the data collection activities of the large internet companies,” Young says. “However, the name of the new tribunal suggests that there may be a ‘data protection’ role separate from privacy.”
If Young is correct, the new legislation should address the criticism that Canada’s privacy laws are laggard on enforcement – so much so that the OPC currently has no power to impose fines or orders.
RELATED ARTICLES
Canada’s privacy regime is a mess
Into the Breach: Canada’s data breach notification regulations
Chatbot aids firms’ privacy compliance by tagging clients’ exposure to data breach laws
Pandemic data hubs and contractual, regulatory and ethical risks
Julius Melnitzer is a legal affairs journalist, writing coach and media trainer for lawyers. Readers can reach him at [email protected] or at https://legalwriter.net/contact.