Canada took a step toward updating its privacy regime June 16, as Minister of Innovation, Science and Industry François-Philippe Champagne and Minister of Justice and Attorney General of Canada David Lametti introduced Bill C-27.
The Digital Charter Implementation Act, 2022 features three pieces of legislation: the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act.
The three-pronged legislation aims to strengthen Canada's data privacy framework, primarily the Personal Information Protection and Electronic Documents Act, and create new regulations for the responsible development of AI, while continuing to implement Canada’s Digital Charter. The proposal would also introduce changes to how privacy is enforced in the nation.
“We are committed to protecting the personal information of Canadians while encouraging responsible innovation for the public good,” Lametti said in a press release. “The Digital Charter seeks to bring essential online protections for individuals into the 21st century. Our government is also modernizing the Privacy Act, Canada’s federal public sector personal information protection statute, to ensure that Canada’s privacy laws keep pace with technological change and continue to reflect evolving Canadian values.”
If the entire package is passed, the proposed Consumer Privacy and Protection Act would replace the PIPEDA. According to the Canadian government, the CPPA would, in part, increase Canadians’ ability to control personal information held about them by organizations, provide more freedom to move that information from one company to another securely, and hold companies that process children’s data to a higher standard.
“By introducing the Digital Charter Implementation Act, 2022, we are ensuring that Canadians can trust when and how their information is being used,” Champgane said. “It will also give businesses clear rules to support their efforts to innovate with data and will introduce a new regulatory framework for the responsible development of artificial intelligence systems, while recognizing the need to protect young people and their information.”
The second component of the Digital Charter Act would establish a new tribunal charged with levying monetary penalties against organizations that violate the CPPA. The Office of the Privacy Commissioner of Canada will continue to oversee compliance with the CPPA. It will also be granted authority to issue orders against companies — including the power to order a company to stop collecting personal data — and make recommendations for fines, but it will be the tribunal that would levy the monetary penalties. And those penalties would be steep. According to the release, non-compliant organizations would face penalties of up to 5% of global revenue or $25 million, depending on which monetary fine is greater.
The final component of Thursday's announcement would be the implementation of the Artificial Intelligence and Data Act. The proposed law would require companies building high-impact AI systems to identify, assess and mitigate the risk of harm and bias. It would establish an AI and Data Commissioner under the Minister of Innovation, Science and Industry, which would be charged with monitoring compliance and ordering third-party audits of a given system and potentially sharing findings with other regulators.
“In today’s economy, Canada’s competitiveness depends on our ability to use digital innovation to harness the power of data,” Champagne said. “This will not only promote confidence in the digital space but also ensure a safe, more inclusive and secure digital economy for the benefit of all Canadians.”
The anticipated announcement comes shortly after the retirement of longtime Privacy Commissioner Daniel Therrien, who provided a keynote address at last month's IAPP Canada Privacy Symposium in Toronto. During the speech, Therrien said the current state of privacy in Canada "is one of uncertainty."
In 2020, Canada proposed bill C-11, the Consumer Privacy Protection Act, but that was cleared off the table in 2021 when Canada's federal election was called.
Last week, Prime Minister of Canada Justin Trudeau nominated Philippe Dufresne for the country's privacy commissioner vacancy. Information Commissioner of Canada Caroline Maynard was named interim privacy commissioner through October after Daniel Therrien's term ended June 3.
The first reading of Bill C-27.
