|
In the Parliament Privacy Law Amendments Provide More Evidence of Government Take Over by Private InterestsThe Liberal Government has introduced new privacy legislation, Bill C-11, entitled the Digital Charter Implementation Act, 2020. Minister of Innovation, Science and Industry Navdeep Bains tabled the legislation on November 17. At a press conference the same day, Bains said the legislation will give Canadians the privacy protection they need as big data is increasingly being used in all sectors of the economy. "We must find a way to protect that data, while still being open to the economic opportunities of a data-driven world," he told reporters.
The use of the term "charter" in Bill C-11[1] serves merely to obfuscate and create the impression that the legislation has something to do with the entrenchment of rights that would allow people to exercise control over how their personal information is used in an era where big data is routinely referred to as the "new oil" of the economy. Currently, the collection, use and sharing of personal data is governed by two laws. The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to commercial activities. The Privacy Act applies to governmental and public sector institutions. In brief, Bill C-11 repeals the 20-year old PIPEDA and replaces it with The Consumer Privacy Protection Act. A problem with the limited application of PIPEDA to commercial activities is that political parties are not covered. This is the case even though they are entitled to receive the Elections Canada register of electors, including each elector's unique identifier number, which they use as the base for compiling voter profiles, adding information from various sources. They receive from Elections Canada as well a digital list of who has voted. The cartel parties keep huge databases on electors which also are not subject to privacy legislation. In this regard, the legislation has a new provision enabling organizations not involved in commercial activities to apply for certification of their privacy practices. This may be a Liberal attempt to circumvent the broadly supported demand that political parties be brought under the jurisdiction of privacy laws.[2] It is too soon to tell. Bill C-11 mirrors PIPEDA but includes new provisions that capture technological developments of the past two decades, such as the practice of "de-identification" in the use of artificial intelligence.[3] As for law enforcement, Bill C-11 expands the powers of the Office of the Privacy Commissioner to issue compliance orders, including ordering a company to stop gathering data. It empowers the Office of the Privacy Commissioner to conduct audits. The Commissioner will also be empowered to recommend significant monetary penalties in cases of non-compliance, but not to impose them. That matter will be decided by a new Personal Information and Data Protection Tribunal, set out in Part 2 of Bill C-11. The Tribunal, comprised of three to six individuals appointed by the government, will be the decision-making body on matters of punishment and will also hear appeals of any orders issued by the Privacy Commissioner. Bill C-11 is long and complex. Websites of legal firms specialized in the field of privacy law are abuzz with first-round interpretations of the law. Michael Geist, author of Law, Privacy and Surveillance in Canada in the Post-Snowden Era, says the legislation "will require considerable study to fully understand the implications of the new rules." Others were quick to criticize it, particularly the many provisions that remove the requirement for informed consent. On November 17, the Public Interest Advocacy Centre issued a statement calling for it to be withdrawn and rewritten "to protect consumers, not to favour big business." Executive Director John Lawford stated, "We are aghast that the federal government feels it can weaken consumer privacy with a doublespeak Bill that removes a consumer's right to protect his or her personal information that is used for any 'business activity' if it is 'de-identified' or used for what the government deems is a 'socially beneficial purpose.'" Response of the Privacy CommissionerWhile Bill C-11 enhances the Privacy
Commissioner's powers to monitor and protect the
privacy of Canadians, the drafting of the
legislation reveals a contemptuous disregard for
the expertise and authority of the Office. A mere
five days before the tabling of the legislation,
Privacy Commissioner Daniel Therrien issued
recommendations on how the use of artificial
intelligence should be regulated, emphasizing the
need for a "human-rights centred approach." It is
clear that recommendations issued on November 12,
could not have been taken into consideration by
the Liberal Government, and why it would draft
legislation without receiving the Commissioner's
input is troublesome. There is no legal
requirement for the government to either listen
to, or to seek the input of the Privacy
Commissioner who is appointed by and accountable
to Parliament. Nonetheless, its decision to pay no
heed to the Commissioner speaks volumes about the
takeover of government by private interests. Privacy Commissioner Therrien issued a statement on Bill C-11 on November 19, in which he welcomes some of the improvements in the draft legislation and identifies some problems. He raises concerns about the imposition of penalties falling under the responsibility of a new Tribunal and the appeal mechanism it provides. "We believe citizens should have access to quick and effective remedies. We are examining whether the addition of a new structure is likely to achieve this result," he states. The Privacy Commissioner continues: "That being said, new enforcement powers are only a means, a tool by which to enforce the law. In the case at hand, the primary role of the legislation is to enact standards and rules that effectively protect privacy while permitting and encouraging commercial activities. "We have previously recommended that the law should permit the use of personal information for responsible innovation and socially beneficial uses, which is consistent with the Bill, but within a legal framework (emphasis in original) that would entrench privacy as a human right and as an essential element for the exercise of other fundamental rights. "Bill C-11 opens the door to new commercial uses of personal information without consent, but does not specify that such uses are conditional on privacy rights being respected. Rather, the Bill essentially repeats the purpose clause of the current legislation, which gives equal weight to privacy and the commercial interests of organizations. In fact, the new purpose clause[4] places even greater emphasis on the importance of the use of personal information for economic activity.
"Ultimately, it is up to Parliament to decide how much weight to give to privacy rights and the interests of commercial enterprises. In our view, it would be normal and fair for commercial activities to be permitted within a rights framework, rather than placing rights and commercial interests on the same footing. Generally, it is possible to concurrently achieve both commercial objectives and privacy protection. This is how we envision responsible innovation. However, where there is a conflict, we think that rights should prevail. "In the coming weeks, our work in analyzing the government's legislative proposals will therefore seek, among other things, to identify possible amendments to better promote responsible innovation while respecting rights, including the right to privacy." Notes1. The Digital Charter was announced by Justin Trudeau during a keynote speech at the May 2019 VivaTech Conference in Paris, France. VivaTech is described as "an event bringing together the world's leaders in technology and business." The Oxford Dictionary provides several definitions for "charter." The first is "a written grant by the sovereign or legislative power of a country, by which a body such as a city, company or university is founded or its rights and privileges defined." It also can mean "a written statement of the rights of a specified group of people," such as a charter for patients' rights. Finally, Oxford says it can also mean "A policy or law regarded as enabling people to engage more easily in a specified undesirable activity," with the illustrative sentence, "He described the act as a charter for vandals." 2. The fact that Canadians do not agree with political parties being exempt from privacy legislation has been repeatedly raised over the past fifteen years, particularly since the 2011 Robocall Voter Suppression Scandal when it was revealed that operatives of the Conservative Party had used the information compiled about voters to misdirect them to phony voting places. Even before that, in a survey commissioned by the Office of the Privacy Commissioner of Canada in 2009, an overwhelming majority of Canadians (92 per cent) said that political parties and politicians should be subjected to legislation that sets out rules governing how they collect and handle the personal information of Canadian citizens. Every privacy commissioner across Canada, as well as the current and past chief electoral officers have called for political parties to be covered by PIPEDA. 3. De-identification removes identifying information from a dataset so that data cannot be linked with specific individuals. De-identification can reduce the privacy risk associated with collecting, processing, archiving, distributing or publishing information. De-identification is thus said to balance the contradictory goals of using and sharing personal information while protecting privacy. 4. The Purpose Clause of the Consumer Privacy Protection Act states: "The purpose of this Act is to establish -- in an era in which data is constantly flowing across borders and geographical boundaries and significant economic activity relies on the analysis, circulation and exchange of personal information -- rules to govern the protection of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances."
This article was published in Article Link:   Website: www.cpcml.ca Email: editor@cpcml.ca |
Bill C-11 enacts
the Consumer Privacy Protection Act and
the Personal Information and Data Protection
Tribunal Act, along with consequential and
related amendments to other acts. The long title
of the Consumer Privacy Protection Act,
Part 1 of Bill C-11, confirms an orientation which
puts private economic interests in the first
place: 
"The government
states its refusal to adopt a rights-based
approach is based on constitutional grounds. It
says only the provinces have jurisdiction to
legislate civil rights matters and the federal
Parliament's jurisdiction is limited to trade and
commerce. We will examine this issue further
before presenting our views to the parliamentary
committee that will study the Bill. As the Supreme
Court of Canada pointed out in a recent judgment
on the constitutionality of the Genetic
Non-Discrimination Act, privacy is of vital
interest. It is validly subject to protections in
several federal statutes made under one or another
of the heads of power of Parliament. This should
also apply to the Consumer Privacy Protection
Act, enacted under the trade and commerce
powers of Parliament.