Modernizing Consent and Privacy in PIPEDA

Information Technology Association of Canada

October 2016

Note: This submission was contributed by the author to the Office of the Privacy Commissioner of Canada’s Consultation on Consent under PIPEDA.

Disclaimer: The opinions expressed in this document are those of the author(s) and do not necessarily reflect those of the Office of the Privacy Commissioner of Canada.

---

Summary

The Information Technology Association of Canada (ITAC) appreciates the opportunity to participate in the Office of the Privacy Commissioner’s (OPC) ongoing dialogue on potential opportunities to modernize Canada’s privacy framework. Data has become an increasingly important commodity and driver of innovation in the global economy. We encourage the OPC to factor into its deliberations the high economic stakes involved as it considers recommending legislative changes to Canada’s overall privacy framework.

A strong regulatory framework for privacy, including regulatory oversight and reasonable limitations on how data can be used, are important elements in establishing trust between businesses and their customers. We look forward to working with the OPC, and all stakeholders, to enhance this trust in a manner that balances the protection of privacy with business practicalities in a data-driven economy.

ITAC members are experiencing three general challenges with PIPEDA which we hope the OPC will be able to address through this consultation:

1. Express consent is often over-emphasized in interpretations of PIPEDA. This form of consent has practical limits
2. The Data minimization principle in PIPEDA runs contrary to successful analytics
3. Regulators can take an overly broad view of what constitutes “personal information”

In its current form, PIPEDA is flexible and can accommodate changes in technology and society.  However, technology neutral and principles-based law (such as PIPEDA) can only be effective if the interpretation of the law also remains flexible and reflects practical realities. Should the OPC believe that its hands are tied by the current law (e.g. a risk-based approach to consent cannot be leveraged), and/or if the government pursues amendments to PIPEDA, ITAC would recommend the following changes and broader actions to support achieving the objectives of the legislation:

1. Introduce Guidance or a New Exemption for Legitimate Business Interests
2. Introduce a New Exception to Consent for “Consistent” Purposes
3. Update the Exception to Consent for “Publically Available Information”
4. Recognition from the OPC that the process of anonymizing/de-identifying personal information is not a “use”
5. Support voluntary initiatives to control the risk of re-identifying de-identified data through contractual means in appropriate circumstances
6. Support transparency through voluntary industry-led codes of conduct
7. Support Privacy Innovation

ITAC would welcome the opportunity to participate in further consultations with the OPC, the Department of Innovation, Science and Economic Development and all other stakeholders to develop practical approaches to modernizing consent and privacy that enhance transparency and trust and that work for all Canadians.

The full submission is available in the following language(s):

English (PDF document)

Note: As this submission was provided by an entity not subject to the Official Languages Act, the full document is only available in the language provided.