Bill C-11, Canada’s privacy reform bill, is now likely going to die. In response, Ontario is seemingly opting to go it alone.
In the world of privacy, Canada has effectively been the laughing stock on the International stage. While Canada does have privacy commissioners, those commissioners are reduced to sending strongly worded letters whenever a company breaks the laws. In response, those companies can simply send that letter through the shredder without any real risk of further consequences. Worst case scenario, the commissioners can send more strongly worded letters, ensuring a repeating cycle of, “Yeah? And what are you going to do about it?”
In 2019, it seemed as though politicians finally had enough of Canada being an international embarrassment. The push to strengthen privacy laws through reform received broad party support. Everyone, at the time, knew that change is needed to address the concerns of today. If the debate in other jurisdictions is whether or not the fines are enough of a deterrent, maybe Canada should at least have fines in the first place for privacy violations.
After a year of delay, Canada finally introduced Bill C-11. It introduced this totally novel and totally Canadian approach of if a company blatantly violates privacy laws, then maybe they can be subject to fines. More seriously, while some were criticizing the legislation for not going far enough, the legislation was, at least, a great start to finally getting things under control in Canada.
Unfortunately, as time went on, the Canadian government grew increasingly anti-innovation and anti-Internet. They gradually doubled-down on this stance even as they effectively declared war on free speech with Bill C-10 which is now in legal limbo.
Lobbyists, for their part, pushed against Bill C-11. Obviously, sensing that the legislation might actually bring in enforceable accountability, this kind of thinking was unacceptable to them. As a result, Bill C-11 stalled with Liberals blaming the opposition. This despite the fact that the legislation could have been introduced to committee all this time, yet it never was. As a result, Canadians are continuing to pay the price for Canada’s lack of any real privacy laws that are even remotely trying to keep up on the international stage.
With the House and the Senate adjourned and a potential election happening before the break is over, Bill C-11, unfortunately, seems destined for the dust bin. Corporations operating in the country are no doubt breathing a sigh of relief because mishandling people’s personal information will continue to have no real consequences. Sure, Canadians are paying the price for it, but hey, better them than the bottom line, right?
We are learning that the province of Ontario is finally having enough of this lack of action. Reports have surfaced that they are introducing their own provincial version of Canadian privacy reform. From Lexology:
Ontario has taken a significant step towards implementing private sector privacy legislation in the province.
On June 17, it issued a white paper entitled Modernizing Privacy in Ontario that sets out a model for a new statute. The province aims to implement stronger protections than introduced by the federal government in its privacy reform bill, Bill C-11. If the province’s proposed model becomes law, it will bring in a strict new compliance and enforcement regime and entirely new employment privacy regulation. It will also increase the fragmentation of the Canadian private sector privacy law regime.
Ontario has seized upon the criticism of Bill C-11 in launching its new model. In a letter released at the same time as the Modernizing paper, Minister Lisa Thompson says:
Recently, the Government of Canada introduced Bill C‐11 to update the federal privacy regime. While this was an important step, the protections of this proposed law do not address many of the needs we heard from respondents in our consultations.
My ministry is therefore considering the possibility of provincial legislation that would govern citizen data and set a national gold standard for privacy protection.
In Modernizing, the province draws heavily from the Office of the Privacy Commissioner of Canada’s Bill C-11 critique and reform submissions made by the Information and Privacy Commissioner of Ontario. Although the province appears to have borrowed text from Bill C-11, its model has a rigor closer to that embodied in Bill 64.
The table mentions a number of things including penalties of up to $10 million or 3% of gross annual turnover – whichever is greater. That definitely sounds very similar to Europe’s GDPR law which showcases a penalty of 4% of annual turnover. That penalty has helped yield some blockbuster headlines showcasing 8 figure fines over its three year history.
One thing we didn’t see is whether or not the law (or if there is a law already in place) that mandates the disclosure of a breach or a leak. If a company suffers from either one, is there a window in which they have to disclose this information to an authority? At this stage, we honestly don’t know.
Still, the fact that there are fines even in privacy laws already represents a substantial step forward – a testament to how bad the privacy situation is today. Certainly, it would have been better if the federal Liberal party got off their lazy rear ends and pushed to pass Bill C-11, but this is the situation we find ourselves in. With lack of leadership at the top on this file, provinces stepping in represents the next best thing even if not ideal. What would you rather have? A provincial patchwork of privacy laws that have teeth or nothing at all?
On the plus side, if the federal government does, in fact, actually lifts a finger to reform privacy laws – even in a half measured way – Ontario could at least be part way ready for it thanks to jumping the gun a bit. The other thing to is that Ontario going it alone is another indication that federal privacy laws is badly needed. Maybe it’ll provide further motivation at the federal level to push for privacy reform again.
So, not an ideal situation, but better than nothing.
Drew Wilson on Twitter: @icecube85 and Facebook.
