Editor's note: The IAPP is policy neutral. We publish contributed opinion and analysis pieces to enable our members to hear a broad spectrum of views in our domains.
This week, the Office of the Privacy Commissioner of Canada announced a consultation seeking input on what updated or new guidance the privacy community would like to see. At first glance, the timing might seem odd, as rumors suggest that next week the federal government will introduce legislation to replace or substantially amend the Personal Information Protection and Electronic Documents Act. So why start modernizing guidance based on a law that may soon change?
Even with new legislation, there will still be practical issues that need clarity. And right now, there are gaps that deserve attention.
Guidance shapes how organizations operationalize privacy. Whether under PIPEDA or its successor, clarity on these issues will help businesses comply effectively and maintain trust. The OPC's consultation is an opportunity to influence guidance that is timely, practical and responsive to real-world challenges.
Take cookie banners, for example. Does the OPC believe the current law requires a regular website to have one? Many argue this practice undermines meaningful consent and makes privacy look bad. I'd love to know how many people actually "Manage Preferences" when given the chance.
Then there's age-gating technologies — what solutions are considered acceptable for different contexts? Clear expectations would help organizations implement solutions confidently. And could the OPC publish a list of contractual terms it views as appropriate for data-sharing agreements? This would provide consistency and reduce so much uncertainty. That one would certainly get my vote.
And let's not forget emerging topics like artificial intelligence governance, cross-border data flows and children's privacy. These aren't going away anytime soon. On these issues, I think we can also collectively tell the OPC not to re-invent the wheel if there is otherwise good guidance already developed by provincial or other regulators around the world. If there's a piece of guidance written for a different jurisdiction but would otherwise be applicable to PIPEDA's setting, then I think having the OPC say so is another way of efficiently providing some certainty — all the while helping with the interoperability challenges in our industry.
The OPC wants feedback on which existing guidance documents need updates, what new topics should be addressed, and how guidance can be more actionable and accessible. I think this last part is something to emphasize as it's an opportunity to recommend not just guidance themes but approaches to guidance. Do we prefer high level and flexibility to interpret as we see fit, or as an industry do we crave the clarity that granularity and concrete tools and checklists can offer?
The consultation is open now until 13 March 2026. Submissions can be sent by e-mail to cpvp-opcconsultation1@priv.gc.ca. Full details and consultation questions are available on the OPC's website.
This is a unique opportunity for privacy professionals to shape the future of Canadian privacy standards. For this consultation to be effective, the OPC will have to show that it listened, as it announces new topics for guidance, updates and even new formats. Even as legislative reform looms, practical guidance remains essential. Let's make sure it reflects the realities of compliance and innovation. And if you're like me, you'll submit your feedback right after you finish muttering about cookie banners.
Kris Klein, CIPP/C, CIPM, FIP, is the country leader, Canada, for the IAPP.
This article originally appeared in the Canada Dashboard Digest, a free weekly IAPP newsletter. Subscriptions to this and other IAPP newsletters can be found here.
