The commissioner says parts of the proposed privacy law are worse than PIPEDA

The Federal Privacy Commissioner has come to the fore with his most pointed criticisms of the proposed overhaul of privacy legislation covering the private sector.

In a speech during a virtual conference organized by the Quebec-based consumer publication Option Constomators on Thursday, Privacy Commissioner Daniel Therrien said that key parts of the proposed Consumer Privacy Protection Act (CPPA, also known as C C-11) would be passed on to consumers. Will not increase. Control over their data. He suggested quick and effective remedies for violating the law and encouraged innovation.

In particular, he said that the government wants to increase consumers' data control by adopting some of its guidelines proposed in 2018 so that consumers can give meaningful consent to the use of their personal data. But the CPPA omits an important aspect of our current law, the idea that meaningful consent is required so that the person giving it understands the consequences they are consenting to.

"In addition, privacy notices that serve as the basis for consent will still be allowed to use ambiguous, if not ambiguous, language to describe the purposes for which companies use an individual's data Intends to use. "

Although the law of other jurisdictions requires organizations to identify "specified, explicit and valid" objectives for the use of consumer data, it is not in the proposed C-11.

"In my opinion, this would result in less consumer control than current law," Therrien said.

The CPPA will give the Privacy Commissioner the power to make compliance orders, but the Commissioner to impose the recommended fines to a new data protection tribunal. The tribunal will also hear appeals against the decisions of the OPC.

"We believe that this tribunal, which does not exist elsewhere in this form, will create unnecessary delays for consumers," Therrien said. “The courts are fully capable of reviewing the validity of OPC decisions. Worse, it will encourage companies to choose the path of appeal rather than finding common ground with the OPC when we are about to issue an adverse decision.

"We believe that the addition of this tribunal will delay access to justice for consumers."

Bill C-11 lists only a few of the CPPA violations that justify administrative penalties. Therrien's list does not include obligations relating to the form or validity of a consumer's consent to handling data, nor the many exceptions to consent, "which are at the core of protecting personal information."

It also does not include a violation of the principle of accountability.

Therrien praised Quebec's proposed overhaul of its proposed legislation, the 64 bill, which he said allows privacy commissioners to impose fines and that there is no limit to offenses subject to administrative penalties.

Move in the wrong direction

The OPC believes that the current principle of business accountability in the proposed Act is weak. Therrien said that it defines accountability as descriptive because there is a set of processes that companies choose.

"It's really a form of self-regulation," he said.

The proposed CPPA allows companies with few exceptions to obtain consent from consumers about how their personal data is used. But some exceptions are also pervasive or ill-defined to promote responsible innovation, Therrien said, adding new flexibility given to companies does not match accountability;

He reiterated his call to ensure the right to privacy as a human right. "This is because we have seen time and again how digital technologies have been used to violate these rights."

The CPPA states that the purpose of the Act is "to create rules to govern the protection of personal rules for the protection of personal information. In the past, Therrien has stated that the right to privacy must apply.

"We believe that with significant amendments, the bill could become a solid legislative text that effectively protects the privacy of Canadians," Therrien concluded.

He said he looks forward to meeting with new innovation minister François-Philippe Champagne to discuss possible amendments to the act.

The CPPA will replace the current Personal Information Protection and Electronic Documents Act (PIPEDA). While no date has still been set in law last September, for debate in the Ethics and Privacy Committee of the House of Commons.

Former Ontario Privacy Commissioner Ann Cavucion said Therrien's remarks about the C-11 were "right on the mark."

He said, "I believe he points to an overhaul of the C-11." “Commissioners will never use that terminology. He would not think it appropriate. But given all the weaknesses of the C-11 that it has gone to great lengths to outline you to do a total re-write of the bill. "