Canada: Bill to reform Canada's privacy law introduced, provides for enactment of Consumer Privacy Protection Act | News post | DataGuidance
Canada: Bill to reform Canada's privacy law introduced, provides for enactment of Consumer Privacy Protection Act
ConsentFacilitation of Data Subject RightsEnforcement - OtherLegal ReformEnforcement - PenaltiesSupervisory AuthorityTransparency
Bill C-11 for the Digital Charter Implementation Act, 2020 was introduced, on 17 November 2020, to the House of Commons, which would reform Canada's privacy legislation under the Personal Information Protection and Electronic Documents Act 2000 ('PIPEDA'). In particular, the bill would enact the Consumer Privacy Protection Act ('CPPA'), which would protect the personal information of individuals while regulating organisations' collection, use, or disclosure of personal information in the course of commercial activities, and would repeal Part 1 of PIPEDA and amend PIPEDA's short title to the Electronic Documents Act. In addition, the bill would enact the Personal Information and Data Protection Tribunal Act ('PIDPTA') for the establishment of an administrative tribunal to hear appeals of certain decisions made by the Office of the Privacy Commissioner of Canada ('OPC') under the CPPA, and facilitate the imposition of penalties.
More specifically, the CPPA would further meaningful consent requirements, and would require organisations to delete the personal information of individuals who withdraw their consent to the use of their personal information. Furthermore, the CPPA provides for transparency requirements with respect to automated decision-making systems such as with the use of algorithms and artificial intelligence, and facilitates the mobility of individuals' personal data between organisations subject to a data mobility framework. Additionally, the CPPA includes provisions with respect to the retention and disposal of personal information, ensuring the accuracy of information and organisations' commitment to transparency, providing individuals with the possibility to access and amend their personal information, and provides the OPC with broader order-making powers and the ability to require organisations to comply with the law, among other things. With respect to the imposition of penalties, the CPPA would also allow the OPC to make recommendations to the Personal Information and Data Protection Tribunal, and generally provides for the imposition of administrative monetary penalties of up to 3% of global revenue or CAD 10 million (approx. €6,433,220), while allowing for the imposition of a maximum fine of 5% of global revenue or CAD 25 million (approx. €16,083,050) for certain serious contraventions.
Innovation, Science and Economic Development Canada also released, on 17 November 2020, a factsheet on the Digital Charter Implementation Act, 2020, detailing key aspects of the bill.
You can read the bill and track its progress here, and read the factsheet here.
ConsentFacilitation of Data Subject RightsEnforcement - OtherLegal ReformEnforcement - PenaltiesSupervisory AuthorityTransparency
Bill C-11 for the Digital Charter Implementation Act, 2020 was introduced, on 17 November 2020, to the House of Commons, which would reform Canada's privacy legislation under the Personal Information Protection and Electronic Documents Act 2000 ('PIPEDA'). In particular, the bill would enact the Consumer Privacy Protection Act ('CPPA'), which would protect the personal information of individuals while regulating organisations' collection, use, or disclosure of personal information in the course of commercial activities, and would repeal Part 1 of PIPEDA and amend PIPEDA's short title to the Electronic Documents Act. In addition, the bill would enact the Personal Information and Data Protection Tribunal Act ('PIDPTA') for the establishment of an administrative tribunal to hear appeals of certain decisions made by the Office of the Privacy Commissioner of Canada ('OPC') under the CPPA, and facilitate the imposition of penalties.
More specifically, the CPPA would further meaningful consent requirements, and would require organisations to delete the personal information of individuals who withdraw their consent to the use of their personal information. Furthermore, the CPPA provides for transparency requirements with respect to automated decision-making systems such as with the use of algorithms and artificial intelligence, and facilitates the mobility of individuals' personal data between organisations subject to a data mobility framework. Additionally, the CPPA includes provisions with respect to the retention and disposal of personal information, ensuring the accuracy of information and organisations' commitment to transparency, providing individuals with the possibility to access and amend their personal information, and provides the OPC with broader order-making powers and the ability to require organisations to comply with the law, among other things. With respect to the imposition of penalties, the CPPA would also allow the OPC to make recommendations to the Personal Information and Data Protection Tribunal, and generally provides for the imposition of administrative monetary penalties of up to 3% of global revenue or CAD 10 million (approx. €6,433,220), while allowing for the imposition of a maximum fine of 5% of global revenue or CAD 25 million (approx. €16,083,050) for certain serious contraventions.
Innovation, Science and Economic Development Canada also released, on 17 November 2020, a factsheet on the Digital Charter Implementation Act, 2020, detailing key aspects of the bill.
You can read the bill and track its progress here, and read the factsheet here.
