Companies could face hefty fines under new Canadian privacy law

The federal government is threateningto imposefines that could run tomillions of dollarsonprivate companies that violate Canadians' privacy.

Innovation Minister Navdeep Bains introduced the Digital Charter Implementation Act today officially called an "Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts." It representsone of the biggest shakeups inCanada's privacy lawin decades.

If the bill passes,companies could facefinesofup to five per centof global revenue or $25 million whichever is greater for the most serious offences. Bains said the legislation provides for the heaviest finesamong theG7 nations' privacy laws.

"The fines are there to provide accountability," Bains told reporters.

The legislation also wouldgive the federal privacy commissionerorder-making powers something Privacy CommissionerDanielTherrienhas long asked for including the ability to force an organization to comply andto order a company to stop collecting data or using personal information.

Bains said the commissioner alsowouldbe able to recommend fines to a new Personal Information and Data Protection Tribunal, which would levy administrative monetary penalties and hear appeals of orders issued under the new law.

According to the wording of a government press release, thelegislation also would give Canadians the option of demandingthat their personal onlineinformation be "destroyed".

Consent rules

The federal government has been signalling a more user-friendly system sinceit first floated the idea of a digital charter.

if the draft legislation passes, companies would have to obtain consent from customers through plain language not a long, jargon-filled legal document before using their personal data.

TheCanadian Internet Registration Authority, the not-for-profit agency that manages the .ca internet domain, praised the new bill.

WATCH |Bains explains how fines would be laid if companies contravene the new privacy legislation

Bains explains how fines would be laid if companies contravene the new privacy legislation

4 years ago

Duration 1:25

Innovation Minister Navdeep Bains tabled new privacy legislation today in the Commons.

"Trust is critical to the digital economy, and central to a well-functioning internet. Canadians must be able to trust that their personal data will be protected and not abused," said CIRA president Byron Holland in a media statement.

"Companies that handle massive troves of personal data must be held accountable for protecting that data, be transparent about how they use itand face real consequences should they break the trust of their users."

Conservative MP James Cumming, the party's innovation, science and industry critic, said thatif the Liberals trulycared about Canadiansprivacy rightsthey'd ban the Chinese telecom giant Huawei from operating in Canada.

"While other countries have taken decisive action to stand up for the privacy of their citizens and banned Huawei, the Trudeau Liberals have failed to make a decision and stand up for the privacy of Canadians. There is no excuse for this delay by the Trudeau government," he wrote in a statement.

"When it comes to Liberal legislation, the devil is always in the details. Conservatives will review the legislation to ensure that it protects privacy without imposing burdensome regulations on small businesses who are struggling to keep their doors open during the second wave of the pandemic."

Canada already has two privacy laws. The Privacy Act covers government agencies and federally regulated industries, while the Personal Information Protection and Electronic Documents Act applies to private-sector organizations.

Statistics Canada saidthat about 57 per cent of Canadians online reported experiencing a cyber-security incident in 2018.

WATCH |Bains on Privacy Commissioner's powers

Bains on Privacy Commissioner's powers

4 years ago

Duration 0:43

Industry Minister Navdeep Bains explains the new powers of investigation that the Privacy Commissioner will have under the new Consumer Privacy Protection Act.

The bill is a "big win for privacy in Canada," said Laura Tribe, executive director of OpenMedia, which has long pushed for stronger laws.

"For years, people have been calling on the government to increase protections for our digital privacy, to no avail," she said.
"As a result, protecting the data and privacy of Canadians has been an afterthought for many companies, knowing that there were no meaningful penalties or consequences for bad behaviour."

The group noted the legislation says consent is not required when an organization lacks a direct relationship with a person, which could water down the protections.

The bill is a step in the right direction, said Jim Balsillie, founder of the Centre for Digital Rights. "However, what seems to be missing is a clear recognition of privacy as a fundamental human right."

Increased bureaucracy

Goldy Hyder, president of the Business Council of Canada, said the legislative proposals set out clear rules to protect consumers, promote innovation and strengthen Canadians' confidence in the emerging digital economy.

B.C.'s Information and Privacy Commissioner Michael McEvoytold CBC News that while the bill is a good start, he has issues with how it limitsa privacy commissioner's authority torecommending to a tribunal that a company be fined for breaching the law.

"It seems to methere is no reason why the commissioner shouldn't have the power to administer those fines subject, of course, to the courts," he said.

McEvoy said that requiring a tribunal to reviewa commissioner's recommendation to impose a fine adds anextra layer of bureaucracy that puts people one step further away from getting justice.

He said he likes the provision in the proposed law that would require privacy companies to state in plain and easy-to-understand languagehow they collect information and how they use it.