Canadian Government Debuts Overhauled Federal Privacy Legislation with Introduction of Bill C-11

On November 17, 2020, the Honourable Navdeep Bains, the federal Minister of Innovation, Science and Industry, announced changes to Canada's privacy framework through the introduction of Bill C-11, which introduces two new statutes, the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act, to replace provisions of the Personal Information Protection and Electronic Documents Act (PIPEDA) dealing with Canadian private sector privacy laws. Bill C-11 is the first major overhaul of Canada's privacy regime since the introduction of PIPEDA in 2000.

Bill C-11 details a number of changes to the current Canadian privacy landscape, including:

• added consent requirements, including that consent be in plain language, with companies having to provide better transparency to enable Canadians to understand how their information is collected and used;
• algorithmic transparency, where companies are required to explain how decisions about individuals are made by artificial intelligence driven automated decision-making systems;
• a private right of action for consumers where one must prove losses in order to recover damages;
• the right for individuals who withdraw consent to have their information destroyed, with the ability to bring a complaint to the Office of the Privacy Commissioner if the request is not fulfilled;
• the ability for the Privacy Commissioner of Canada to make binding orders, and to conduct inspections and recommend administrative monetary penalties of up to 5% of global revenue for companies that fail to comply with an order; and
• the development of the Personal Information and Data Protection Tribunal to deal with privacy matters in order to keep complaints out of court.

The Honourable Minister Bains characterized the proposed privacy legislative regime as "an initial step toward a comprehensive reform of Canada's privacy framework" and providing "the strongest privacy protections of any G7 country" including the European Union's General Data Protection Regulation (GDPR) and the state of California's Consumer Protection Act (CCPA). The Minister also made it clear that the Office of the Privacy Commissioner of Canada's budget will receive "the appropriate resources" to ensure they are able to execute their powers to protect Canadians.

Summary By: Hashim Ghazi