Before giving his annual keynote at this year's virtual IAPP Canada Privacy Symposium, Privacy Commissioner of Canada Daniel Therrien briefly considered retrospection. Therrien is nearing the end of his seventh year as privacy commissioner and thought it might be time to look back at what has been accomplished during his tenure.
Therrien ultimately decided against it, feeling it was far more imperative to focus on the future, and there's no shortage of reasons why he wouldn't. Therrien recently shared his submission on Bill C-11 with the House of Commons Standing Committee on Access to Information, Privacy and Ethics. Bill C-11 would revamp Canada's federal privacy law and, in his submission, Therrien said the proposed legislation is "a step back overall" from the Personal Information Protection and Electronic Documents Act.
"It is clear that private sector privacy reform will not come to pass before next Parliamentary recess, which may mean it will not come to pass in the form of Bill C-11 at all," said Therrien. "This gives us a chance to reflect on what law reform might look like when Parliament does return."
Therrien said his objective is not to start from a blank page and ignore existing proposals, but rather to have the privacy community come together and confront the fundamental issues that must be addressed for Canadian law to be effective in a modern environment.
One of those areas of concern is finding a definition of permissible use of data that balances responsible innovation with protecting citizens' rights. Therrien said to properly draw value from personal information, laws should be able to accommodate new and undiscovered methods of data use. Therrien added through Bill C-11, the federal government hopes to achieve this by maintaining a consent model and adopting new exemptions.
The commissioner finds this method to be one that is ultimately unsustainable.
"While some of these exceptions are reasonable, others are too broad or ill-defined to foster responsible innovation," said Therrien. "For example, there is no reasonable justification, in my mind, for an exception to consent based on the impracticability of obtaining consent. This is a very bad way of achieving the goal of responsible innovation. We must face the truth that consent has its place, but it cannot be the only means of protecting privacy."
Therrien has called for rights-based privacy laws in the past and did so once again on the virtual Symposium stage. Therrien addressed a common concern and criticism around a rights-based approach, mainly that it is incompatible with a principle-based data protection framework and would result in an overly prescriptive law.
"I think this is absolutely wrong. The prescriptive nature of a law is often related to the level of detail associated with the definition of specific privacy principles," said Therrien. "A rights-based framework operates at the same level of generality as a principles-based law. Neither is strictly prescriptive. There are both equally flexible and adaptable to regulate the rapidly changing environment, such as the world of technology and the digital economy."
Therrien reiterated his praise for the federal government's movement toward a rights-based approach with its efforts to modernize the Privacy Act. In the government's discussion paper on Privacy Act reform, Therrien cited one of the key objectives of the legislation, which is to protect "individuals’ human dignity, personal autonomy, and self-determination.” Therrien said this excerpt shows the federal government does understand the concept of treating privacy as a human right.
Interoperability is going to be a key component of the quest to reform Canada's federal privacy law. Bill C-11 was crafted to ensure Canada maintains its adequacy status with the European Union. However, a federal privacy bill must also work on a national level as well. With Bill C-11 stuck in its tracks, Therrien said Canada may face a patchwork of provincial privacy laws. While a patchwork may be sufficient in some cases, Therrien said Canada should strive for "substantial similarity," while pointing to Quebec's proposed privacy law update as an example of legislation heading in the right direction.
"Quebec’s Bill 64 is not perfect. Rules on transborder data flows come to mind, but it has several good features that would make it a significantly better privacy law than what the federal government has put forward with currently with C-11," said Therrien. "For example, Bill 64 includes provisions that address profiling and protecting the right to reputation, which are consistent with our approach to rights-based legislation."
Therrien focused his speech on the future of Canada's privacy laws, but there was one area where he did look back to the past. Therrien reflected on Canada's tradition of operating as a leader in privacy and mediating differences on the global stage. In order to maintain its high standing on the privacy sphere, Therrien believes Canada needs to update its current privacy laws and the proposed Bill C-11. Therrien said he is optimistic the federal government will be open to improving Bill C-11. He also said Canada may have no other choice.
"I really think that we would show tremendous leadership by having legislation that would try and take the best of the non-prescriptive nature of our current laws and the laws of certain other countries, but also the rights-based approach that is in place in Europe, but not only in Europe," said Therrien. "By seeking to reconcile these approaches, we would play our traditional role and of course, more importantly, would better protect the privacy of Canadians while offering legislation that would be totally open to responsible innovation."
Photo by Zia Syed on Unsplash
