Canada’s privacy law made brief waves when Facebook rejected the commissioners report, but questions about the laws strength are continuing to be raised.
Late last month, Canada’s privacy law quickly came into focus after Facebook rejected the BC and Canadian privacy commissioner’s report. At the time, the commissioners called the report a great reason for federal regulators to grant the commissioner more power to hold companies accountable for people’s personal information. In response to Facebook’s rejection, the commissioners announced that they intend on taking Facebook to court over their handling of the Cambridge Analytica scandal.
In response to the developments, MPs from the Liberal, NDP, and Conservative parties all seemed to be on the same page over strengthening Canada’s privacy laws. As we point out, the commissioners power over companies is more or less telling them, “Stop, or we’ll say stop again!” All this in the midst of other jurisdictions such as the US and European Union levelling multi-billion dollar fines against the company.
More recently, Michael Geist weighed in, pointing out that PIPEDA, Canada’s privacy law, did receive Europe’s stamp of approval. Unfortunately, with the latest developments, that approval could be tested. From Geist’s comments:
With companies seemingly free to reject privacy commissioner findings – Facebook earns more than enough revenue every sixty seconds to pay the maximum PIPEDA penalty – Canadians are left without effective privacy protection. Innovation, Science and Economic Development Minister Navdeep Bains touted changes to the law that added new penalties, but the reality is that Canadian law now badly lags behind other countries.
The obvious solution starts with granting the Office of the Privacy Commissioner order making power and supplementing the law with penalties that would make companies think twice before ignoring PIPEDA.
The Office of the Privacy Commissioner was admittedly slow to recognize that the effectiveness of the law depends upon serious enforcement. In 2006, Jennifer Stoddart, then the federal privacy commissioner, told a House of Commons committee that order making powers were not a priority. A year later, it took federal court ruling to push a reluctant commissioner’s office to investigate foreign entities collecting personal information from Canadians.
Today, as global companies are on the verge of regarding Canadian privacy law as irrelevant and the European Union is increasingly likely to re-examine its decision to consider Canadian law “adequate” for the purposes of cross-border data transfers, the office has rightly become convinced that the law must be upgraded. That leaves the question of what more Mr. Bains and the government need to recognize that their vision of leadership in the digital economy is being undermined by privacy rules that leave millions of Canadians without effective and enforceable protection.
This sentiment echo’s our analysis.
Of course, PIPEDA wasn’t always seemingly this week. In fact, closer to its inception, Canada’s privacy laws were seen by some as a gold standard. After all, how many countries out there have a privacy commissioner not just at the federal level, but at the provincial level as well? Indeed, PIPEDA was, at least for a time, seen as a point of pride for Canadian’s.
Now, it seems that PIPEDA’s strength may have been inflated by Canadian pride – and Facebook pricked that balloon with a rather large needle. As the laws strength continues to diminish with companies simply not caring about the law and fines being so small that companies can simply rummage around the couch for the spare pocket change to pay off fines, re-thinking the law is certainly an understandable response.
Of course, as we pointed out a number of times already in this story, with a Canadian election approaching, a lot of issues will come to the forefront. Whether privacy will manage to be a blip on the radar with issues like the environment, the economy, and accountability remains to be seen. With so much apathy surrounding the realm of privacy, this is still going to be an incredibly tall order to begin with.
Drew Wilson on Twitter: @icecube85 and Facebook.
