The Constitutional Validity of Bill C-11, the Digital Charter Implementation Act

Opinion Prepared for the Office of the Privacy Commissioner of Canada

Frank Addario and Samara Secter

March 31, 2022

ADDARIO
LAW GROUP LLP

---

I. OVERVIEW

The Privacy Commissioner of Canada (PCC) retained Addario Law Group LLP to provide a legal opinion regarding the constitutionality of Bill C-11 – the Digital Charter Implementation Act, 2020. In our view, the Bill would be a valid exercise of the Federal Trade and Commerce Power. Given the development in division of powers jurisprudence over the last five years, and the prevalence of the digital economy, we believe a court would find the Bill constitutional.^{Footnote 1}

In 2020, the Federal Government introduced the Digital Charter Implementation Act.

The Bill would create two separate Acts: the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act.

The Consumer Privacy Protection Act (CPPA) would replace the Personal Information Protection and Electronic Documents Act (PIPEDA) in outlining the responsibilities of commercial organizations with respect to handling personal information. It also introduced new potential penalties for failures to meet those responsibilities. The Personal Information and Data Protection Tribunal Act (PIDPTA) established a Tribunal to hear appeals from organizations and complainants affected by findings and orders made under the CPPA and impose financial penalties where appropriate.

During Parliamentary debates, some MPs questioned whether Bill C-11 was a legitimate exercise of federal powers or unjustifiably encroached on provincial powers.^{Footnote 2} The Federal Government defended the Bill as an exercise of the s. 91(2) Federal Trade and Commerce Power- General. This is a familiar debate. The constitutional validity of PIPEDA was also questioned on the basis that the protection of personal information is a s. 92 matter of "property and civil rights" under provincial jurisdiction. However, the issue has never been determined in Court. In our view, a Court would confirm the validity of Bill C-11 were it to be tested.

The PCC proposed amendments to Part I of the Digital Charter Implementation Act. In our view, these amendments either strengthen or do not affect the constitutionality of the proposed Act.

The questions we address and the answers to them are:

1. What is the General Trade and Commerce (GTC) Power?
   
   The general trade and commerce power allows Parliament to legislate over (a) international and interprovincial trade and commerce and (b) the general regulation of trade affecting the whole dominion. Bill C-11 is justified under (b), the general regulation of trade.
2. What is the Pith and Substance of the Consumer Privacy Protection Act?
   
   The pith and substance of the proposed CPPA is the promotion of economic growth by creating an enforceable national standard of privacy protection for consumers.
3. Do the amendments that the PCC proposed to the CPPA change the pith and substance of the Act?
   
   No.
4. Is Bill C-11 a valid exercise of the GTC power?
   
   Yes.
5. Are the PCC's proposed amendments to the CPPA consistent with the GTC power?
   
   Yes.

II. THE GENERAL TRADE AND COMMERCE POWER

Under s. 91(2) of the Constitution Act, 1867, the Federal Government has authority to make laws in relation to the regulation of trade and commerce. Section 91(2) has two branches: (i) the power over international and interprovincial trade and commerce, and (2) the power over general trade and commerce affecting Canada as a whole.^{Footnote 3} This opinion concerns the second branch, as Bill C-11 not only regulates international and interprovincial organizations, but also intraprovincial organizations.^{Footnote 4}

For Parliament to justify legislation under the second branch of the s. 91(2) power, the pith and substance of the federal legislation must first relate to the national economy. Once that hurdle is cleared, the courts ask whether the law falls within the federal government's GTC Power.^{Footnote 5}

To test the validity of the legislation under the GTC power, the courts apply a 5-part test developed in General Motors:

1. Is the law part of a general regulatory scheme?
2. Is the scheme under the oversight of a regulatory agency?
3. Is the law concerned with trade as a whole rather than with a particular industry?
4. Is the scheme of such a nature that the provinces, acting alone or in concert, would be constitutionally incapable of enacting it? and,
5. Would a failure to include one or more provinces or localities in the scheme jeopardize its successful operation in other parts of the country?^{Footnote 6}

Although non-exhaustive, if the answer to these questions is yes, that will strongly suggest that the subject matter of a federal enactment is genuinely a national economic concern.^{Footnote 7}

III. THE PITH AND SUBSTANCE OF BILL C-11

In determining the pith and substance of legislation, courts will consider:

• The general architecture of the legislative scheme;
• Intrinsic evidence (the Act's title, preamble, and purpose provisions);
• Extrinsic evidence (Hansard, debates, or contributions from Committees); and,
• The law's legal and practical effects.

For the law to be a valid exercise of the GTC power, the mischief it addresses must be a genuinely national economic concern. The protection of privacy itself would therefore be insufficient to fall under the GTC power because it is not, on its own, economic. However, the protection of privacy to sustain the economy is a matter of genuine national economic concern.

1. General Architecture of the Bill

Bill C-11 "An Act to Enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make related and consequential amendments to other Acts" or the "Digital Charter Implementation Act" repeals PIPEDA and replaces it with a new regime governing the use and protection of personal information during commercial activity.

Part 1 of Bill C-11 introduces the Consumer Privacy Protection Act. Part 1 of the CPPA outlines the prohibitions and obligations of organizations with respect to the maintenance, use and disclosure of personal information, collected during commercial business.^{Footnote 8} Part 2 of the CPPA outlines the Privacy Commissioner's powers and obligations in monitoring, enforcing, and overseeing organizations' compliance with the obligations outlined in Part 1. Part 2 includes an expanded role for the Commissioner, as well as the ability to recommend penalties for breaches of certain provisions of the CPPA to a newly established tribunal.

The CPPA applies broadly to every organization that collects, uses, or discloses personal information during commercial activities.^{Footnote 9} However, the Governor in Council may exempt certain organizations, activities, or class of activities if satisfied that substantially similar provincial legislation applies to the collection, use, or disclosure of personal information.

Part 2 of Bill C-11 introduces the Personal Information and Data Protection Tribunal Act (PIDPTA) which establishes a Tribunal to address issues identified under the CPPA. Both complainants and organizations can appeal findings, orders and decisions made by the Commissioner to the Tribunal. The Tribunal has the power to impose penalties on an organization after receiving recommendations from the Commissioner and conducting a hearing. Decisions of the Tribunal are final, but subject to judicial review under the Federal Courts Act.

Based on historical criticisms of PIPEDA and comments in the legislature during the debates, any potential constitutional challenge would likely be to Part 1 – the CPPA – as opposed to Bill C-11. The remainder of the opinion, therefore, focuses on the CPPA, and to some degree, how it interacts with PIDPTA.

2. Intrinsic Evidence

Courts look at an Act or provisions' intrinsic evidence to determine its main purpose. This includes the text of the law, the structure of the law, the law's title and the provisions that address the law's purpose.^{Footnote 10}

a. Long Title of the CPPA Demonstrates Economic Focus^{Footnote 11}

The title of Bill C-11, Digital Charter Implementation Act, suggests that the law is intended to implement the Digital Charter launched by the Minister of Innovation, Science, and Industry in 2019. The Digital Charter prioritizes innovation in the digital economy on the basis of consumer trust.^{Footnote 12}

However, Bill C-11's short title is unlikely to be the focus of constitutional analysis. Instead, Courts are likely to zero in on the long and short titles of the CPPA.

The long title of the CPPA, An Act to support and promote electronic commerce by protecting personal information that is collected, used or disclosed in the course of commercial activities, suggests that its pith and substance is the promotion of e-commerce through the protection of personal information. The short title – the Consumer Privacy Protection Act – is similar but does not address the promotion of commerce as obviously as the long title. However, the focus of the title is still commercial, as the Act is centered around protecting consumers' privacy.

b. Purpose and Key Provisions

The purpose of the CPPA is to create national rules to protect individuals' privacy to sustain commercial activities:

The purpose of the Act is to establish – in an era in which data is constantly flowing across borders and geographical boundaries, and significant economic activity relies on the analysis, circulation and exchange of personal information – rules to govern the protection of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use, or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.^{Footnote 13}

The key provisions^{Footnote 14} are:

• Broad Application Clause: the Act applies to every organization, employees or applicants in federal works or undertakings, and personal information collected or used interprovincially or internationally (s. 6);
• "Substantially Similar Clause": all organizations within a province with substantially similar legislation may be exempt from the Act (s. 6(2)(b)) and (s. 119(2)(b));
• Limited Collection, Use: Collection, Use, or Disclosure for appropriate purposes only (ss. 12-14);
• Consent Provisions: valid consent required for the collection, use or disclosure of individual's personal information and narrow exceptions (ss. 15);
• Commissioner Oversight: Broad oversight, management and inquisitorial role for the Commissioner to ensure compliance (ss. 76-92);
• Penalties: Commissioner recommends penalties later imposed (ss. 93- 94); and,
• Role of Tribunal: right of appeals, appeals with leave, and orders (ss. 100-105)

These provisions work in concert with the purpose provision to offer privacy protections to consumers in the course of interacting with businesses. Collectively, the key provisions suggest that the thrust of the Act is to create broadly applicable, enforceable rules to protect individuals' privacy with the effect of sustaining commercial activity.

3. Extrinsic Evidence

a. Hansard

In considering the pith and substance of an Act or provision, the Court can review the statute's legislative history including the Hansard or minutes of the Parliamentary committees.^{Footnote 15} Minister Bains, introducing Bill C-11 explained that the focus of the Bill was on promoting economic growth and stability by creating a national standard of privacy protection:

• The three pillars of the proposed law (consumer control, responsible innovation, and a strong enforcement and oversight mechanism) work together to give Canadians what they need to engage in the economy.^{Footnote 16}
• The Bill protects Canadians' privacy while strengthening the ability of Canadian businesses to compete globally.^{Footnote 17}

Minister Champagne, who overtook Minister Bains' portfolio in 2021, made comments that similarly supported the genuinely economic concern of the Bill:

• Economic growth requires that we consider how to modernize and strengthen privacy laws in the marketplace.^{Footnote 18}
• Bill C-11 seeks to strikes the right balance between privacy imperatives and the need to boost Canadians' confidence in the digital economy.^{Footnote 19}
• The foundation for a robust digital and data-driven economy is trust.^{Footnote 20}
• In order to build a strong, innovative national economy, privacy rules have to be harmonized at the national level.^{Footnote 21}

4. Legal and Practical Effects

When determining pith and substance, courts will consider the legal and practical effects of the law. The legal effects are those that flow from the provisions of the statute and practical effects are the indirect effects of the same.^{Footnote 22} The legal effect of provisions 9-52 of the CPPA is to create national standards for commercial organizations to comply with to ensure adequate protection of personal information in the course of business. Part II is the method by which the Commissioner, Tribunals and private actions investigate compliance with and enforce national standards set out in Part I.

While it is impossible to measure the practical impact of proposed legislation, similar provisions in PIPEDA had the effect of creating a national scheme for personal information disclosed and used in the course of commercial activity. Businesses across the country reshaped their personal information practices, which in tum gave consumers more assurance that their private information surrendered in market and other transactions was safe.

The CPPA may be better at encouraging compliance than PIPEDA because of its stringent enforcement measures. These include the Privacy Commissioner's expanded role and the availability of monetary penalties and private law actions for breaches. These proposed changes may have a stronger deterrent effect for commercial entities who wish to break the rules.

5. Conclusion on Pith and Substance

The pith and substance of Bill C-11 is the promotion of economic growth by creating an enforceable national standard of privacy protection for consumers.^{Footnote 23}

IV. THE COMMISSIONER'S PROPOSED AMENDMENTS DO NOT CHANGE THE ACT'S PITH AND SUBSTANCE

The Privacy Commissioner proposed amendments to Bill C-11. Of those, this opinion focuses on:

(1) the addition of a preamble, (2) changes to the purpose provision, and (3) amendments to ss. 12 and 13. In our view, none of the proposed amendments change the pith and substance of the Bill away from its national economic focus. In fact, some of the amendments will add to the constitutional validity of the Bill by clarifying the centrality of the national economy to the Bill and its promotion through stringent privacy protection.

1. The Preamble

Preambles are helpful tools for courts to use to illustrate the mischief that a certain Act addresses.^{Footnote 24} The absence of a preamble can lead to confusion or disagreement regarding the raison d'être of a law.^{Footnote 25}

a. The Amended Preamble Does Not Change the Pith and Substance

The Commissioner's proposed preamble consists of 11 clauses, which can be grouped into five different points:^{Footnote 26}

1. Privacy is a basic human right that protects autonomy, dignity, and the functioning of democracy (paras. 1, 2, 4, and 10);
2. Privacy is necessary to the proper functioning of our society and its economy (para. 3);
3. Our current economic and technological context means that a massive quantity of personal data is collected in ways that can both benefit and adversely affect even the most vulnerable (paras. 5, 6 and 7);
4. The purpose of the CPPA is to promote commerce by ensuring the protection of individuals ' privacy rights (paras. 8 and 9); and,
5. The Act has been recognized by the courts as being quasi-constitutional in nature (para. 11).^{Footnote 27}

The proposed preamble, with a specific focus on paragraph 8, suggests the thrust of the CPPA is strengthening the economy through the protection of privacy.

In our opinion, this preamble would not change the pith and substance of the current legislation. Although privacy rights do play a prominent role in the proposed preamble, they do not overwhelm the economic nature of the Act. Particularly with respect to (d) above, privacy underscores the promotion of the economy. In other words, the preamble demonstrates that consumer confidence is elevated through strong privacy protection, and the elevation of consumer confidence promotes economic growth.

This wording is like the Draft Federal Act considered in the Pan Canadian Securities Regulation Reference (2018). In that case, the preamble focused on the need for coordinated market regulation to promote and protect the stability of Canada's financial system.^{Footnote 28} The Court concluded that the Act was not about regulating day-to-day securities trading but rather, had the goal of systemic market regulation – a legitimate purpose under the GTC power.

Similarly, the CPPA is not about day-to-day regulation of personal information or any particular industry. Instead, it has the overarching goal of economic promotion and incentivizing market participation through protecting consumer privacy – a legitimate purpose under the GTC power.

b. Potential Criticisms of the Preamble

One possible criticism of the proposed preamble is that it recenters the Act's focus on cementing and protecting privacy rights, instead of economic growth. This could arguably be an indication that the pith and substance is not genuinely economic in nature, but rather, is a vehicle for privacy protection.

There are two answers to this criticism. The best is that it ignores the interrelatedness of privacy and the economy. The scheme is intended to promote the economy by protecting privacy. The evidence before Parliament suggests that consumers are less likely to engage in many forms of modern commercial activity unless their personal information is protected by law.^{Footnote 29} Since modern commerce does not respect provincial boundaries, national standards are required to protect this aspect of the economy.

The second answer is that the regulation of privacy can exist under both federal and provincial jurisdiction. Parliament is entitled to protect privacy in so far as it impacts national economic interests-jurisdictional silos are not required. Parliament's jurisdiction to promote the economy through the protection of privacy does not strip provincial ability to further protect privacy.

c. Potential Solutions

To remove any doubt about the pith and substance of the Bill as economic growth and stability, we recommend the following changes to the preamble:

• Relate the clauses focused on privacy rights to economic growth or the importance of privacy in the commercial context;
• Move clause 8 – the objective of the Act – to the beginning of the list; and,
• Highlight the importance of national standardization for privacy rights.

The first two suggested changes would demonstrate that the CPPA is not only about privacy rights but rather is about economic growth through privacy protections.

The last suggested change would highlight the importance of national standards of privacy to the economy. For instance, in the Reference re GGPPA, the Chief Justice noted that the preamble's emphasis on the necessity of immediate, nation-wide action assisted his conclusion that the pith and substance of the statute was establishing minimum national standards for GHG pricing across the country to reduce emissions.^{Footnote 30} While this change may not meaningfully alter the Act's pith and substance, it would underscore the genuinely national nature of the economic concern, and would be helpful in assessing whether the five indicia from General Motors are met.

2. Amendments to the Purpose Clause Cement the Constitutionality of the Act

The PCC recommends making the following amendments to the purpose clause of the CPPA:

These suggested amendments would not change the pith and substance of the Act away from the promotion of economic growth and stability through privacy protection. If anything, the amendments strengthen the commercial nature of the Act and articulate how Parliament will address sustaining the economy in the context of rapidly circulating personal information. In particular, the following amendments strengthen the economic focus of the Act:

1. The movement of "significant economic activity" as dependent on personal information to the beginning of the purpose clause resets the context of the Act;
2. The recognition that the promotion of confidence in the privacy of one's personal information is necessary for the sustainability of information-based commerce underscores the pith and substance already identified; and,
3. The addition of 5(c) underscores the importance of nation-wide standards for when personal data may move outside of Canada.

One addition that would assist with the Bill's constitutional validity would be (d) the necessity for nation-wide standards of privacy protection due to inter-provincial commerce and the nature of the digital economy.

3. Proposed Amendments to ss. 12 and 13 would have Minimal Impact on the Pith and Substance or Constitutional Validity of the Act

a. Proposed Amendment to s. 12

These proposed amendments would have little effect on the pith and substance of the Act. Because the Act contemplates the necessity of strengthening privacy protections to strengthen the economy these proposed changes simply contribute to the Act's current pith and substance.

The recognition of the fundamental nature of privacy rights does not detract from the Act's commercial nature. This is particularly true given that clauses 12(2)(b) and (c) both recognize that the context for collection is with respect to the legitimate business needs of an organization. The purpose of enforcing the importance of privacy rights, then, is not to have a stand-alone privacy protection, but to encourage economic participation by equipping consumers with the knowledge that their personal information is collected only for legitimate business needs.

Some might argue that the proposed deletions from 12(2)(d) and (e) be interpreted as making privacy the primary thrust of the Act above economic interests. However, if the changes to (d) and (e) are read with the proposed preamble and amended purpose provisions, a fair analysis shows strengthening of privacy provisions is an attempt to strengthen the national economy. In other words, the counter argument is that improving privacy protections betters economic participation, which in turn benefits economic sustainability.

With respect to (e), one might argue that the implication is that there are some situations in which privacy will be protected over the business wishes of an organization. However, the Act is in service of the national economy generally, and not a particular business or industry. While there may be situations in which privacy trumps a particular business' desires, the goal of the Act is to create a thriving economy through privacy protection. The Act, through s. 12(2)(e), protects the long-term economic gain from consumer trust and confidence in the safety of divulging private information in the marketplace.

b. Proposed Amendment to s. 13

The amended s. 13 would read: The organization may collect only the personal information that is necessary for the specific, explicit, and legitimate purposes determined and recorded under s. 12(3).

In our view, this amendment will have no impact on the pith and substance of the Act.

V. DOES BILL C-11 MEET THE GENERAL MOTORS TEST FOR CONSTITUTIONAL VALIDITY UNDER THE GTC POWER?

After determining that the pith and substance is of an economic nature, the next question the Court would ask is whether the proposed law meets the 5-part General Motors test for validity under the General Trade and Commerce Power. Our opinion is that the CPPA does.

1. Is the law part of a general regulatory scheme?

Although CPPA and PIDPTA are two separate statutes, if enacted, they would have created together a coordinated scheme of regulation in relation to the commercial collection, use, and disclosure of personal information.

In General Motors, Justice Dickson found the Combines Investigation Act, created a regulatory scheme because the legislation (1) identified prohibited conduct, (2) created an investigatory procedure, and (3) established a remedial mechanism.^{Footnote 31} These three criteria are equally apparent in the proposed Bill.

a. Prohibited Conduct

In general, the Act sets out a complex scheme of rules that identify, define and stop anti-privacy conduct.

Sections 12-18, and 53-55, outline a set of obligations and prohibitions with respect to the collection, use and disclosure of information. For example:

• Section 13, for example, states that an organization may only collect personal information for purposes that a reasonable person would consider appropriate. This limit is in essence a prohibition on the collection of information for purposes that a reasonable person would consider inappropriate. The failure to follow these obligations results in investigatory procedures and potential penalties.^{Footnote 32}
• Section 14 prohibits an organization from use or disclosure of personal information without consent other than for a purpose determined appropriate and reasonable.
• Section 53 prohibits the retention of personal information for a period longer than necessary to fulfil the purpose for which it was collected.

b. Investigatory Procedure

Part 2 of the proposed CPPA, outlines the Privacy Commissioner's powers, duties, and functions to enforce the Act's obligations and prohibitions.

c. Remedial Mechanisms

With respect to the last criteria, the remedial mechanisms are set out in both the CPPA and PIDPTA. Section 92(2) allows the Commissioner, after an inquiry, to order an organization to: take compliance measures, cease doing something that is in contravention of the Act, comply with prior agreements, or take other public measures to fulfill the organization's obligations under the Act.^{Footnote 33} Section 93-4 of the CPPA sets out the penalties that the Commissioner may recommend because of a contravention of the Act, and PIDPTA imposes those penalties.

It is irrelevant that an aspect of the regulatory scheme for the CPPA is set out in the PIDPTA. As the Federal Court of Appeal confirmed in Compufinder, a regulatory scheme can be contained in a single provision, a severable part of an Act, or it can comprehend an entire piece of legislation.^{Footnote 34}

It is our opinion that the Bill passes the first part of the General Motors test.

2. Is the scheme under the oversight of a regulatory agency?

The Bill also passes the second part of the General Motors test. The Privacy Commissioner oversees the scheme.

The Regulatory Agency at issue – the Privacy Commissioner of Canada – must have a significant degree of control over the operation of the Act.^{Footnote 35} Here, he does.

• The Commissioner oversees the complaint process, inquiries and audits;
• The Commissioner approves of codes of practice and certification programs for different entities (ss. 76(3) and 77(2));
• The Commissioner may make orders against an organization to stop doing anything in contravention of the Act and comply with the Act (s. 92(2));
• The Commissioner may, after completing an inquiry, decide whether to recommend a penalty be imposed on the organization by the Tribunal (s. 93).

It is non-determinative that the Commissioner cannot impose financial penalties and can only make recommendations to the Tribunal. Simply put, the Tribunal cannot operate without the Commissioner's oversight. For instance, the Tribunal relies on the findings made by the Commissioner (s. 94(2)).^{Footnote 36} Further, the Tribunal's jurisdiction is limited to appeals from ss. 100 and 101 and penalty imposition under s. 94.^{Footnote 37} In other words, without CPPA oversight by the Commissioner, the Tribunal would have no work to do.^{Footnote 38}

The oversight of the Privacy Commissioner under Bill C-11 is similar to, if not more involved than, the Oversight of the Director of Investigation and Research under the Combines Investigation Act, which satisfied the 2^nd requirement of the General Motors test. Like the Combines Investigation Act, the Privacy Commissioner conducts inquiries and can refer recommendations to a further regulatory body (the PIDPTA tribunal).^{Footnote 39} This satisfied the Court's regulatory oversight requirement in General Motors, and so too, should the oversight and management of the Privacy Commissioner of Canada.

3. Is the law concerned with trade as a whole rather than with a particular industry?

In our view, the legislation also meets the third requirement of the General Motors test.

a. The Legislation has Broad Application

The Act broadly defines "commercial activity" as any act or conduct that is of a commercial nature.^{Footnote 40} Similarly, "organization" includes an association, partnership, person or a trade union.^{Footnote 41} The applicability section, s. 6, confirms that the law does not address any particular industry. The Act explicitly applies to every organization that collects, uses or discloses personal information in the course of commercial activity and personal information about employees or applications for employment in connection with a federal work or undertaking. The "greater certainty" clause that follows confirms that the Act applies even if the information is collected interprovincially or internationally or collected, used, and disclosed within a province (so long as the province is not exempt.)

b. Previous Jurisprudence Confirms that the Act is Concerned with Trade as a Whole

Unlike the Act in issue in the 2011 Securities Reference, the CPPA does not regulate "all aspects" of contracts in a particular industry.^{Footnote 42} Nor does the CPPA control the day-to-day regulation of one kind of business.^{Footnote 43} Instead, the legislation has "horizontal application" to any kind of business or company in Canada^{Footnote 44} :

• In General Motors, the Court found that regulating anti-competitive business does not apply to a specific place, business or industry.^{Footnote 45} The same is true of anti-privacy activity;^{Footnote 46}
• In the 2018 Securities Reference, the Court found that the Draft Federal Act did not descend into the detailed regulation of all aspects of trading in securities. Both the CPPA (and enforcement through PIDPTA) address risk to the economy generally, not the stability of one sector.^{Footnote 47}
• Finally, in Compufinder, Nadon JA noted that e-commerce has become a pillar of Canada's national economy.^{Footnote 48} He found that regulating unsolicited emails can address electronic threats which have both direct and indirect costs on all kinds of businesses. The same is true of privacy protections. As Canadians become increasingly concerned with their digital privacy and the increasing availability of their information an absence of adequate protections for personal information threatens trade as a whole in Canada. This threat permeates Canada's economy and is not confined to any specific industry or sector.

c. The Act Does Not Legislate Over Information as a Commodity

Some critics of PIPEDA suggest that it regulates the trade in personal information as a commodity, and therefore cannot meet the third branch of the General Motors test.^{Footnote 49} This is a misunderstanding of the role of PIPEDA and the proposed role of Bill C-11.

First, PIPEDA and Bill C-11 focus on establishing "fair information practices" to ensure healthy economic growth.^{Footnote 50} They are not primarily concerned with how information is marketed and traded as a commodity like securities. It is not only about the "industry" of personal information. Second, even if personal information were a commodity, which could be contested, it is a commodity that is foundational to almost every business in the country.^{Footnote 51} Therefore, focusing on "personal information" as a commodity does not change the answer to the question of whether the law is concerned with "trade as a whole" into a negative.

d. Privacy in Business is a National Concern

Privacy protection in business is a national concern – it is not industry or province specific. In a national study, the Privacy Commissioner reported the following findings:

• 87% of Canadians expressed some level of concern about the protection of their privacy, including 32% of Canadians who said they are extremely concerned about protection of their personal privacy.
• A significant minority of Canadians disagreed with the statement "I feel that businesses in general respect my privacy rights".
• While 81% of Canadians said they have at least a fair amount of trust in banks to protect personal information:
  • 51% had not much trust or no trust at all in Telcos and internet companies to protect personal information;
  • 58% had not much trust or no trust at all in Big Tech to protect personal information; and,
  • 57% had not much trust or no trust at all in online retailers to protect personal information.
• 88% of Canadians are at least somewhat concerned about how companies and organizations might use information available about them online to make decisions about them.
• 7 in 10 Canadians have refused to provide personal information due to privacy concerns.^{Footnote 52}

The concerns of Canadians are not theoretical. The CPPA offers protection to the economy by alleviating these concerns and allowing consumers to participate in the marketplace nationally.

4. Is the scheme of such a nature that the provinces, acting alone or in concert, would be constitutionally incapable of enacting it?

Recently, in both 2018 Securities Reference and Reference re GGPPA, the Supreme Court fleshed out the meaning of the fourth General Motors requirement. If the legislation has national goals relating to systemic risk that affect the economy, provinces, acting alone or in concert, will be constitutionally incapable of enacting the legislation.

In short, this question is not about "jurisdictional capacity" in the sense that a provincial government may have the constitutional ability to enact substantially similar legislation.^{Footnote 53} Rather, the question asks whether the pith and substance is concerned with national goals and addresses national risks to the economy. As the Court made clear in General Motors, the validity of the federal legislation must be determined "without heed to the provincial legislation".^{Footnote 54} Therefore, the presence of an already existing provincial law that addresses the subject matter does not determine the constitutionality of federal legislation.

Chief Justice Dickson noted in General Motors that competition is not a singular matter, and that the provinces, too, are jurisdictionally equipped to manage competition in the exercise of their legislative power. His point, however, was that regardless of that practical provincial capacity, "Parliament also has the constitutional power to regulate intraprovincial aspects of competition."^{Footnote 55} This analysis applies equally to privacy in the course of business.

Provincial incapacity means that provinces can choose to establish uniform minimum protections for privacy, but this does not "assure a sustained approach to minimum national standards."^{Footnote 56} Because provinces retain the constitutional sovereignty to resile from an interprovincial scheme and can therefore opt against participating in a cooperative approach, federal legislation needs to fill the gap.^{Footnote 57} If a truly national approach is necessary, the provinces are incapable of enacting it.^{Footnote 58}

In our view, the Bill passes the fourth criterion from General Motors.

5. Would a failure to include one or more provinces or localities in the scheme jeopardize its successful operation in other parts of the country?

This question focuses on whether matters "transcend provincial interests and are truly national in importance and scope."^{Footnote 59} If a province failed to participate in the scheme, would the goal of economic promotion through privacy protection be jeopardized? In our view, yes.

With the increase in cross-provincial and international consumerism, the effect of inadequate privacy protection in one place can be deleterious to the national economy.^{Footnote 60} The requirement for privacy transcends borders.^{Footnote 61} Further, because consumers may not know where the organization to whom they are providing their information is based, the lack of protections in one jurisdiction could undermine trust in the economy everywhere in Canada. National standards prevent unworkable, fragmented measures across the country.^{Footnote 62}

National standards also prevent the creation of provincial havens from regulation to which businesses may flock.^{Footnote 63} Justice Nadon, in Compufinder, noted that if one province had more lenient laws with respect to commercial electronic messages, spammers could use cloud computing to easily arrange to disseminate spam from servers located in that province.^{Footnote 64} The same is true of privacy laws. If one province had more lenient privacy protections, information leaving the country from that province may be more easily accessed by malicious third parties, or certain organizations may move their practices there to benefit from the leniency. This could lead to significant mistrust Canada-wide.^{Footnote 65}

The analysis in General Motors, Kirkbi AG, Securities Reference (2018), and the Reference re GGPPA are all applicable in this case.

• In General Motors, the Court determined that competition is not an issue of purely local concern, but one of crucial importance to the national economy. Dickson C.J. noted that the deleterious effect of anti-competitiveness transcends provincial boundaries.^{Footnote 66} The same is true of anti-privacy conduct.
• In Kirkbi, the Court found that the exclusion of one province from the trademark regime would have the effect of undermining the legislation as a whole, because unregistered trademarks could be more strongly protected than registered trademarks.^{Footnote 67} This speaks to the "haven" concern identified above. If one province has a relaxed or no privacy regime, it may be that businesses would flock to that jurisdiction. Canadian consumers' information could leave the country with no protection creating distrust in the economy nation-wide and the global economy.
• In the 2018 Securities Reference the Court found that a provincial failure to participate could seriously impair the scheme's capacity to protect the Canadian economy. The same is true if any provinces fail to adopt sufficient privacy protections.
• In the References re Greenhouse Gas Pollution Pricing Act, the Court noted that "carbon leakage" – the phenomenon by which businesses in sectors with high levels of carbon emissions relocate to jurisdictions with less stringent carbon pricing policies – was a risk to the national goal of the proposed Act.^{Footnote 68} The same is true if some provinces are allowed to operate with no minimum standards for privacy protection. To be certain, creating policies and implementing practices that protect consumer privacy take time and resources. If businesses flock to provinces in which they can conduct business without privacy protections, the national economy may suffer as consumers may choose to participate less frequently.

The Bill therefore likely passes the fifth branch of the General Motors test.

VI. ARE THE PCC'S PROPOSED AMENDMENTS TO THE CPPA CONSISTENT WITH THE GTC POWER?

In our view, the PCC's proposed amendments would not change any of the answers to the General Motors test. Even with the amendments, all questions would still be answered in the affirmative, and some with even greater force.

However, the amendments, if changed in the manner we suggested above, could underscore the economic nature of the concern, the importance of a unified, national standard, and the deleterious effect of any provincial derogation to the success of the operation. These suggestions would further serve to cement the legislation's constitutionality as an exercise of the GTC power.