Statement from the Privacy Commissioner of Canada following the tabling of Bill C-11

GATINEAU, QC, November 19, 2020 – Privacy Commissioner of Canada Daniel Therrien today issued the following statement regarding the tabling of Bill C-11, the federal government’s proposed new private-sector privacy legislation:

The Office of the Privacy Commissioner of Canada (OPC) welcomes the recent introduction of Bill C-11, which aims to modernize federal privacy law as it relates to the private sector. This ambitious reform initiative includes several significant improvements. However, the Bill also raises a number of questions about its ability to effectively protect privacy in a constantly evolving digital society.

Among these improvements, we see a complete rewriting of the Act’s structure. The old model, which reproduced verbatim an industry code of conduct, is replaced with a clearer, more readable law that sets out rights and obligations rather than recommendations.

The Bill would adopt elements of our Guidelines for obtaining meaningful consent, and would create new transparency requirements for the use of artificial intelligence.

The Bill would give the OPC real order-making powers, rather than the more limited powers proposed in the government’s 2019 Digital Charter. However, financial penalties would fall under the responsibility of a new tribunal, which would also be an appeal body for the OPC's decisions. We believe citizens should have access to quick and effective remedies. We are examining whether the addition of a new structure is likely to achieve this result.

That being said, new enforcement powers are only a means, a tool by which to enforce the law. In the case at hand, the primary role of the legislation is to enact standards and rules that effectively protect privacy while permitting and encouraging commercial activities.

We have previously recommended that the law should permit the use of personal information for responsible innovation and socially beneficial uses, which is consistent with the Bill, but within a legal framework that would entrench privacy as a human right and as an essential element for the exercise of other fundamental rights.

Bill C-11 opens the door to new commercial uses of personal information without consent, but does not specify that such uses are conditional on privacy rights being respected. Rather, the Bill essentially repeats the purpose clause of the current legislation, which gives equal weight to privacy and the commercial interests of organizations. In fact, the new purpose clause places even greater emphasis on the importance of the use of personal information for economic activity.

The government states its refusal to adopt a rights-based approach is based on constitutional grounds. It says only the provinces have jurisdiction to legislate civil rights matters and the federal Parliament's jurisdiction is limited to trade and commerce. We will examine this issue further before presenting our views to the parliamentary committee that will study the Bill. As the Supreme Court of Canada pointed out in a recent judgment on the constitutionality of the Genetic Non-Discrimination Act, privacy is of vital interest. It is validly subject to protections in several federal statutes made under one or another of the heads of power of Parliament. This should also apply to the Consumer Privacy Protection Act, enacted under the trade and commerce powers of Parliament. 

Ultimately, it is up to Parliament to decide how much weight to give to privacy rights and the interests of commercial enterprises. In our view, it would be normal and fair for commercial activities to be permitted within a rights framework, rather than placing rights and commercial interests on the same footing. Generally, it is possible to concurrently achieve both commercial objectives and privacy protection. This is how we envision responsible innovation. However, where there is a conflict, we think that rights should prevail.

In the coming weeks, our work in analyzing the government's legislative proposals will therefore seek, among other things, to identify possible amendments to better promote responsible innovation while respecting rights, including the right to privacy.