Canadian privacy laws are changing \u2013 here are some practical steps to help businesses adapt to Quebec\u2019s Law 25 and proposed federal Bill C-27.<\/p>\n\n\n\n
On April 24, 2023, Bill C-27, also known as the Digital Charter Implementation Act, 2022<\/em>[1]<\/a>, passed its second reading at the House of Commons and was referred to the Standing Committee on Industry and Technology (the \u201cCommittee<\/strong>\u201d) for further study. As Bill C-27 progresses towards becoming law, businesses must make strategic and tactical plans for complying with new privacy, data protection, and cybersecurity requirements.<\/p>\n\n\n\n This article highlights key changes to Canada\u2019s federal privacy laws introduced by Bill C-27, briefly compares these changes to some new rules imposed by Quebec\u2019s Act respecting the protection of personal information in the private sector<\/em> (\u201cQuebec Private Sector Act<\/strong>\u201d)[2]<\/a> as amended by Law 25[3]<\/a>\u2014 most of which came into force in September 2023 \u2014 and provides a checklist of practical tips to assist you in making your business\u2019 practices compliant.<\/p>\n\n\n\n Bill C-27 was introduced by the federal government on June 16, 2022 with the aim to implement three new pieces of federal legislation: (1) the Consumer Privacy Protection Act<\/em> (\u201cCPPA<\/em><\/strong>\u201d), (2) the Personal Information and Data Protection Tribunal Act<\/em> (\u201cPIDPTA<\/em><\/strong>\u201d), and (3) the Artificial Intelligence and Data Act<\/em> (\u201cAIDA<\/em><\/strong>\u201d).<\/p>\n\n\n\n This article focuses on privacy compliance, but as we have reported in other publications and articles, AIDA <\/em>is a crucial piece of legislation and is the first attempt to specifically regulate artificial intelligence in Canada<\/a>. Much is uncertain about AIDA\u2019s practical consequences at this time, and AIDA will certainly not be finalized in isolation, but Canada\u2019s \u201cVoluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems<\/em>\u201d was published on September 27, 2023, and offers some guidance to businesses as Bill C-27 progresses. By contrast, compliance under the CPPA<\/em> is considerably clearer in terms of what businesses can expect, as discussed below.<\/p>\n\n\n\n The CPPA<\/em> is intended to repeal the privacy provisions of the Personal Information Protection and Electronic Documents Act<\/em> (\u201cPIPEDA<\/em><\/strong>\u201d)[4]<\/a> and replace them with a new legislative framework governing the collection, use, and disclosure of personal information for commercial activity in Canada. The CPPA<\/em> applies to the same organizations that are currently subject to PIPEDA. <\/em>This means, from a jurisdictional perspective, that provincial privacy law applies to organizations in the same circumstances as under PIPEDA <\/em>(the provinces of Quebec, Alberta and British Columbia have their own privacy laws and several other provinces have privacy laws limited to health data). Similar to PIPEDA<\/em>, the CPPA<\/em> will also apply only to \u201ccommercial activities.\u201d[5]<\/a><\/p>\n\n\n\n In many cases, the CPPA<\/em> holds the line while adding clarity with respect to certain aspects of PIPEDA<\/em>, such as accountability. For example, under the CPPA<\/em>, organizations will need to designate an individual responsible for ensuring their compliance with legislated obligations and for implementing a privacy management program that includes designated information.[6]<\/a> Additionally, each organization will be accountable for handling all the personal information it \u201ccontrols,\u201d whether it is handled by the organization itself or a service provider acting on its behalf.[7]<\/a> These requirements will be newly codified in the CPPA<\/em> but they already existed in principle under PIPEDA<\/em> through less detailed obligations and guiding principles.[8]<\/a><\/p>\n\n\n\n At the same time, the CPPA introduces key changes in several areas, including enforcement. More severe penalties for violations of the CPPA and its regulations will be enforced, including administrative monetary penalties of up to $10 million or 3% of global revenue, and fines of up to $25 million or 5% of global revenue. Notably, the PIDPTA creates a new administrative tribunal to enforce penalties under the CPPA and hear appeals of orders by the Privacy Commissioner.<\/p>\n\n\n\n The CPPA <\/em>also introduces new rules around consent. It adds exceptions allowing for the collection, use and disclosure of personal information without consent[9]<\/a> and identifies information to be used when obtaining valid consent from consumers, which must be presented in understandable plain language.[10]<\/a><\/p>\n\n\n\n Other notable changes under the CPPA<\/em> include:<\/p>\n\n\n\n More recently, at the end of September 2023, the Minister of Innovation, Science and Industry outlined additional expected amendments to Bill C-27 in a letter to the Committee that has been studying the Bill. The letter sets out several planned amendments to the CPPA<\/em> and AIDA<\/em>. The amendments to the CPPA<\/em> include explicitly recognizing Canadians\u2019 fundamental right to privacy in the purpose section of the CPPA<\/em>, requiring organizations to consider the special interests of children with respect to their personal information, and granting more flexibility to the Privacy Commissioner in relation to compliance agreements with non-compliant organizations, including the ability to impose financial penalties. The changes to AIDA<\/em> include specifying distinct obligations for generative AI systems, like ChatGPT, and aligning AIDA <\/em>with regulations for artificial intelligence in the European Union.<\/p>\n\n\n\n Bill C-27 should not be confused with Quebec\u2019s Law 25 (formerly known as Bill 64). Law 25 amends the Quebec Private Sector Act<\/em>. Most of which came into force in September 2023. The Quebec Private Sector Act<\/em> applies to the collection, use and communication of personal information that takes place in Quebec. Consequently, any organization conducting business in Quebec should be mindful of its implications.<\/p>\n\n\n\n Both Law 25 and Bill C-27 aim to modernize Canadian approaches to privacy laws and, as a result the new frameworks they introduce contain some similarities related to accountability and transparency, with some nuances however. For example, Law 25 implements new rights for individuals that are similar to those discussed above, including the right to be informed of automatic processing and the right to data portability (in the latter case, this provision will come into force on September 22, 2024).<\/p>\n\n\n\n Both regimes require appointment of a designated person responsible for privacy compliance. However, the Quebec Private Sector Act<\/em> requires this person to be the person with highest authority in the organization (unless another person is specifically appointed in writing), and also requires that the organization make their title and contact information public.[17]<\/a> Additionally, both frameworks require organizations to ensure their service providers effectively protect personal information, but the Quebec Private Sector Act<\/em> sets out specific contractual provisions that must be included in service provider agreements.[18]<\/a> The Quebec Private Sector Act<\/em> also includes the additional obligation of conducting privacy impact assessments in certain cases, including when personal information is transferred or processed outside Quebec.[19]<\/a><\/p>\n\n\n\n Notably, Bill C-27 and Law 25 take slightly different approaches to consent.[20]<\/a> For example, the Quebec Private Sector Act<\/em> permits organizations to rely on implied consent to collect and use personal information, under certain conditions, in accordance with the disclosed purposes for which it was collected. However, express consent is always required in cases of sensitive information or in the case of profiling (e.g. in the case of cookies). Bill C-27 sets express consent as the starting point and permits reliance on implied consent \u201cwhere it is appropriate,\u201d taking into account reasonable expectations and the sensitivity of the information.[21]<\/a> Other differences of note relate to their respective schemes for enforcement and penalties for non-compliance as well as notification requirements in instances of data breaches, among others.<\/p>\n\n\n\n These developments in Canada\u2019s approach to privacy provide businesses with the opportunity to take stock and review their own privacy practices for compliance with both the current obligations that will be carried over from PIPEDA<\/em> to the CPPA<\/em> and other changes brought on by Bill C-27 and Law 25 (where applicable).<\/p>\n\n\n\n Broadly speaking, businesses will want to review and update their internal practices and public-facing policies regarding the collection, use, disclosure and storage of personal information. You may wish to consider the following questions as part of your business\u2019s compliance planning (as a start and keeping in mind that other questions will need to considered as well):<\/p>\n\n\n\n Consider if the Quebec<\/em> Private Sector Act<\/em> is applicable to how your business handles personal information and whether your policies or procedures should be updated for compliance.<\/p>\n\n\n\n Review and update your business\u2019s consent procedures, including policies regarding whether exemptions apply, when new consent must be obtained, and how revocations of consent are handled.<\/p>\n\n\n\n Ensure the language in your business\u2019s privacy policy and requests for consent is understandable and contains appropriate disclosures to meet transparency obligations.<\/p>\n\n\n\n Determine in what cases you may be a controller of personal information or a service provider. Review and update contracts with service providers to meet accountability obligations and appropriately disperse legal risk.<\/p>\n\n\n\n Appoint an individual in charge of privacy compliance and develop a privacy management program. That individual should at least conduct a data mapping exercise as well as update or establish the required privacy policies and procedures.<\/p>\n\n\n\n Review and update your business\u2019s data storage and retention policies to ensure appropriate safeguards are implemented to protect personal information and personal information is not held longer than permitted.<\/p>\n\n\n\n Ensure staff handling personal information have received up-to-date training regarding use of safeguards, reporting data breaches, record keeping and handling requests from individuals.<\/p>\n\n\n\n Conduct audits to ensure staff compliance with policies and procedures.<\/p>\n\n\n\n Should you have any questions regarding these developments, please reach out to any member of Miller Thomson\u2019s Privacy and Data Protection<\/a> team and stay tuned for the announcement of an upcoming webinar on these topics.<\/p>\n\n\n\n [1]<\/a> Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts<\/em>, 1st<\/sup> Sess, 44th<\/sup> Parl (second reading April 24, 2023).<\/p>\n\n\n\n [2]<\/a> CQRL, c P-39.1.<\/p>\n\n\n\n [3]<\/a> An Act to modernize legislative provisions as regards the protection of personal information<\/em>, SQ 2021, c 25.<\/p>\n\n\n\n [4]<\/a> Personal Information Protection and Electronic Documents Act<\/em>, SC 2000, c 5.<\/p>\n\n\n\n [5]<\/a> CPPA<\/em>, s 6.<\/p>\n\n\n\n [6]<\/a> CPPA<\/em>, s 9.<\/p>\n\n\n\n [7]<\/a> CPPA<\/em>, ss 7 and 11.<\/p>\n\n\n\n [8]<\/a> PIPEDA<\/em>, s 5, Schedule 1.<\/p>\n\n\n\n [9]<\/a> CPPA<\/em>, s 18-52.<\/p>\n\n\n\n [10]<\/a> CPPA<\/em>, s 15(4).<\/p>\n\n\n\n [11]<\/a> CPPA<\/em>, s 2(2).<\/p>\n\n\n\n [12]<\/a> CPPA<\/em>, s 55.<\/p>\n\n\n\n [13]<\/a> CPPA<\/em>, s 72.<\/p>\n\n\n\n [14]<\/a> CPPA<\/em>, s 63.<\/p>\n\n\n\n [15]<\/a> CPPA<\/em>, s 107.<\/p>\n\n\n\n [16]<\/a> CPPA<\/em>, s 76-129.<\/p>\n\n\n\n [17]<\/a> Quebec Private Sector Act<\/em>, s 3.1.<\/p>\n\n\n\n [18]<\/a> Quebec Private Sector Act<\/em>, s 18.3.<\/p>\n\n\n\n [19]<\/a> Quebec Private Sector Act<\/em>, s 3.3 and 17.<\/p>\n\n\n\n [20]<\/a> For more information regarding the validity of consent in Quebec, please see these guidelines published by the Quebec regulator<\/a> on October 31, 2023 (in French only).<\/p>\n\n\n\nEnhanced privacy requirements of Bill\u00a0C-27: What\u2019s new<\/h2>\n\n\n\n
\n
More anticipated changes<\/h2>\n\n\n\n
Comparing Bill C-27 and Quebec\u2019s Law 25<\/h2>\n\n\n\n
Privacy law compliance checklist for businesses<\/h2>\n\n\n\n
Does Quebec\u2019s Private Sector Act apply to your business?<\/h3>\n\n\n\n
Do your business\u2019s consent procedures need to be updated?<\/h3>\n\n\n\n
Is the language in your privacy policy clear?<\/h3>\n\n\n\n
Do contracts with service providers need to be updated?<\/h3>\n\n\n\n
Do you have a privacy management program?<\/h3>\n\n\n\n
Do you have safeguards in your data storage and retention policies?<\/h3>\n\n\n\n
Is your staff appropriately trained to handle personal information?<\/h3>\n\n\n\n
\n\n\n\n