Digital Charter Implementation Act – Strengthening Online Personal Information Privacy
This article was written by Emil Levkovsky, 2L.
Digital Charter Implementation Act – The Federal Government Aims to Strengthen Online Personal Information Privacy and Data Protection
In the 21st century, Big Tech effectively demonstrated just how valuable personal data and information can be. Since then, companies from all different industries have been finding different ways to adequately collect and use data for commercial gain. A rapidly evolving digital landscape requires an evolving legal system that is able to keep up to ensure adequate protections for its citizens. The Canadian Federal Government is trying to tackle this issue head-on.
On November 17th, 2020, the Federal Government introduced a new bill titled: An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts, short name: Digital Charter Implementation Act, 2020 (DCIA) in the House of Commons. As per the title, the Act aims to do two things: firstly, to establish new privacy laws for the private sector titled Consumer Privacy Protection Act (CPPA) and secondly to create an administrative tribunal to hear appeals of decisions made by the Privacy Commissioner and to have oversight to ensure organizations comply with privacy requirements.
DCIA Part 1 – Proposing the Enactment of the Consumer Privacy Protection Act (CPPA)
The goal of the CPPA is to increase protections for Canadians’ personal information that is collected, used or disclosed in the course of commercial activities. The Act particularly focuses on ensuring companies acquire meaningful consent prior to collecting the personal data of Canadians. Companies would also be required to guarantee that the data collected is up to date and individuals would have the right to withdraw consent at any moment. This comes with a caveat as the CPPA lists many exceptions (with some being quite broad) where consent would not be required. For example, consent for collecting data is not required for journalistic, artistic or literary purposes.
The CPPA also pushes for higher levels of security in that organizations would be required to implement specific safeguards to limit data breaches. In the case where breaches occur, they must be reported to the Privacy Commissioner. The CPPA also pushes for higher levels of openness and transparency from organizations regarding when and how they use personal data.
Lastly, the Act contains several other features such as encouraging data mobility so that individuals can have their data move from one organization to another, and the ability for individuals to request that their information be “de-identified”.
DCIA Part 2 – Proposing the Enactment of the Personal Information and Data Protection Tribunal Act
Part 2 of the DCIA suggests the creation of the Personal Information and Data Protection tribunal charged with the enforcement of current regulations. This Tribunal would work in tandem with the Privacy Commissioner to ensure Part 1 of the DCIA and other relevant privacy law is being adhered to by organizations. The Tribunal would have the power to investigate complaints, resolve disputes, make inquiries, enforce orders and impose penalties and audits.
A key point to highlight is just how steep the fines could be. Under the Act, the Tribunal could levy fines of up to $25 million dollars or 5% of global revenue (whichever is higher) for specific offences. This gives the Tribunal serious power when it comes to enforcing adequate compliance.
Although this bill has just been introduced, it is a significant step in the right direction when it comes to modernizing the protections in place for personal information for Canadians. Through the creation of oversight boards, stricter regulations and the use of fines, the Government is indicating that they will be taking on a more serious approach to privacy protections. It also puts Canada more in line with other nations that have robust digital protections for their citizens.
 Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts, 2nd Sess, 43rd Parl, 2020 (first reading 17 November 2020).  Ibid at 38.  Ibid at 58.