Canada’s Newly Proposed Bill C-11: A Historic Step For Improved Canadian Privacy
The Canadian government proposed a new privacy law that would give Canadians more control over how companies might collect and potentially exploit their data and personal information. Even more than that, the new privacy law promises hefty fines to be imposed for any company that breaks the new stricter rules.
The context of the new bill
The Canadian government explained in a news release its justification behind the timing of the new law being linked to the COVID-19 pandemic. The pandemic having transformed how Canadians not only work, connect with one another, but also access information — making digital technology the most important it has ever been yet. As a result, the privacy of Canadian citizens has become more at risk, and the government has recognized their responsibility to Canadians are able to lead their everyday lives in a newly digital space and be able to know their data and personal information is secure and respected. The Honourable Navdeep Bains, Minister of Innovation, Science, and Industry in his introduction of the proposal elaborated on how:
“As Canadians increasingly rely on technology we need a system where they know how their data is used and where they have control over how it is handled. For Canada to succeed, and for our companies to be able to innovate in this new reality, we need a system founded on trust with clear rules and enforcement. This legislation represents an important step towards achieving this goal”.
What can be expected
The legislation introduced Tuesday November 17th, reveals that the Canadian government has plans to prioritize user rights in the increasingly unsafe digital world. The offenses committed by companies are to be subject to paying fines based on their revenues — not flat fees. The penalties for some of the administrative offences have the potential to be as high as 3% of the offending company’s global revenues or $10 million CAD, whichever is greater. Companies with serious offences have the potential to be subject to fines as much as 5% of their global revenues or $25 million CAD, whichever amount is higher. Trudeau intends to ensure that Canada has the strictest penalties among its fellow Group of Seven countries France, Germany, Italy, Japan, the United Kingdom, and the United States.
The bill is officially titled “An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts”, or better known as Bill C-11, is a historic event in the making. The new bill is the first significant attempt to alter and improve Canadian privacy law in several decades. While the details of the bill have yet to be released as the legislation is still to be tabled, Bain’s mandate letter outlines the promises to come.
The mandate letter written reflects the orders from Prime Minister Justin Trudeau, and discusses the task of creating a draft for a “digital charter”. This charter is to include legislation that would protect Canadians but also provide an “appropriate compensation” when the personal data of citizens does get breached. Among the promises in the letter, the new bill is to encourage a better protection of Canadians’ personal data through new and stricter regulations for large digital companies. Notably, the bill is to appoint a data commissioner to oversee these regulations and see to it that there is more competition in the digital marketplace — but for the right reasons.
An industry perspective
The Canadian Marketing Association has been following the development of the bill very carefully, and engaging with the government to receive as much information as possible to prepare in advance to the bill coming into effect. While one might expect marketers to be deeply concerned about the new bill, it appears there are a few positive outcomes of the bill:
“Marketers will be pleased that the CPPA preserves Canada’s model of express or implied consent, giving organizations the choice of which type of consent is most acceptable.”
Even though the bill’s creation means tighter security for personal information and imposes difficulties for companies and marketers who rely on much of said data to do their jobs, the bill also proposes new ways for data to be safely collected. The bill outlines exemptions to consent for collection — the use or even the disclosure of Canadians’ personal information — for “socially beneficial purposes”, research and development, certain prescribed business activities, transfers between service providers, and for those organizations that are parties to a completed or prospective business transaction.
Given that the categories of information being collected and used are in compliance with the regulations in the act, marketers are free to use any publicly available information without consent. However, that does not go without saying for Canadian businesses and marketers especially, the new bill has many changes that will take time to adjust to. Some of the new rights assigned to Canadians such as the right for consumers to request a company completely deletes all their personal information on demand, or to transfer it to another service provider will prove itself to be a new industry challenge.
Luckily, with all of its uncertainty and challenges on the way, the law has a long way to go before it becomes finalized. A significant amount of lead-up time assigned before the privacy regulations do change will provide businesses and marketers alike some time to prepare in advance. This time will include up to an 18 month implementation period right after the bill becomes a law. The future of Canadian business is about to change — the question is how will Canadians react as both citizens with new rights and business owners or marketers with higher stakes than ever?
