Extract from Canada Gazette on “substantially similar” criteria

September 22, 2001

Department of Industry

Personal Information Protection and Electronic Documents Act

Process for the Determination of “Substantially Similar” Provincial Legislation by the Governor in Council

This notice is to advise the public of the process Industry Canada will follow for determining whether provincial/territorial privacy legislation that applies to the private sector will be deemed “substantially similar” to the Personal Information Protection and Electronic Documents Act (PIPEDA), pursuant to paragraph 26(2)(b) of the Act.

Background

The alignment of federal and provincial/territorial legislative regimes for the protection of privacy in the private sector will make privacy laws easier for individuals to understand and simpler for businesses to implement. In addition, greater harmonization will create a more consistent set of rules with regard to the protection of personal information covering all businesses and organizations across all sectors, including those sectors such as health which are largely subject to the legislative or regulatory authority of provinces/territories. Reflecting the importance of harmonizing federal, provincial and territorial legislative regimes governing the protection of privacy, the PIPEDA contains a provision, paragraph 26(2)(b), which gives the Governor in Council the power to “if satisfied that legislation of a province that is substantially similar to this Part applies to an organization, a class of organizations, an activity or a class of activities, exempt the organization, activity or class from the application of this Part in respect of the collection, use or disclosure of personal information that occurs within that province.” The effect of this provision is to enable provinces/territories to regulate the personal information management practices of organizations operating within their borders and to minimize the imposition of a dual regulatory regime on these organizations. In those areas of activity under provincial/territorial jurisdiction where substantially similar provincial/territorial legislation is in effect, only out of province/territory flows of personal information will be subject to the PIPEDA.

The former Minister of Industry described substantially similar legislation as legislation that provides a basic set of fair information practices which are consistent with the CSA Standard, oversight by an independent body and redress for those who are aggrieved.” (December 2, 1999, Minister Manley to the Standing Senate Committee on Social Affairs, Science and Technology).

Procedural Issues

What is the process for Government decision-making and approval?

The Governor in Council, on the recommendation of the Minister of Industry, will make a determination of substantially similar pursuant to paragraph 26(2)(b) and make the appropriate Order. Following the usual practice, the Minister of Industry will prepare recommendations to the Governor in Council in consultation with other interested departments and agencies.

What will trigger a formal determination of “substantially similar” under the Act?

To begin the process, a province/territory or an organization, e.g., a credit reporting agency, can advise the Minister of Industry of the existence of provincial/territorial legislation (either in force or to come into force at a future date), which they believe is substantially similar to the federal law. In the case of an organization providing such notification, the Minister of Industry will write to the Minister responsible for the relevant provincial/territorial legislation in order to seek that Minister’s views. The Minister of Industry may also act on his/her own initiative to recommend to the Governor in Council, following consultation with the provinces or territories involved, to designate provincial/territorial private sector privacy legislation as substantially similar.

No organization or activity can be exempted from the application of the PIPEDA, pursuant to paragraph 26(2)(b), unless the Governor in Council has made the appropriate Order.

Will a decision on “substantially similar” refer to a specific provincial/territorial law, or a province’s/territory’s legislative regime in general, i.e., to more than one law in a province/territory or to an activity or class of activity, such as credit reporting, which is governed by similar legislation in the provinces/territories?

Under paragraph 26(2)(b), the Governor in Council has the power to exempt organizations or activities which are subject to a provincial/territorial law from the application of the federal law within the province/territory. Since the exemption refers to “organization, activity or class” for collections, uses or disclosures, the Order can take into account an entire provincial/territorial legislative regime for protecting personal information in the private sector, which may involve a single comprehensive privacy protection law (e.g., Quebec), or multiple provincial/territorial laws within or across provincial/territorial jurisdictions (e.g., the credit reporting legislation found in a number of provinces/territories).

Can sector-specific legislation qualify as “substantially similar”?

As outlined above, the Order can exempt organizations or activities governed by sector-specific provincial/territorial legislation that is deemed substantially similar, e.g., provincial/territorial health information legislation which applies to organizations, such as pharmacies, that are engaged in commercial activities in the health sector.

Will there be a formal opportunity for public comment?

Industry Canada is publishing this notice in the Canada Gazette to announce the request for consideration pursuant to paragraph 26(2)(b) and to invite comments from the public. Such comments will be considered in the preparation of the Minister’s recommendation to the Governor in Council.

What is the role of the Privacy Commissioner of Canada?

As an independent Officer of Parliament, the Privacy Commissioner can present his views on provincial privacy/territorial legislation, including draft legislation, as he deems appropriate. Subsection 25(1) of the PIPEDA requires the Commissioner to report to Parliament annually, and to report specifically on “the extent to which the provinces have enacted legislation that is substantially similar … and the application of any such legislation.” The Privacy Commissioner may consult directly with his counterparts or any other person who is in a position to assist him in the relevant provinces prior to the release of his annual report.

In order to allow the Privacy Commissioner to carry out his mandate under subsection 25(1) of the PIPEDA, the Minister of Industry will inform the Privacy Commissioner of a request under subsection 26(2) when it is received, and will seek the Privacy Commissioner’s view as to whether the legislation is “substantially similar” to the PIPEDA. For all submissions to the Governor in Council, the Minister will consider and include the views of the Privacy Commissioner.

The Privacy Commissioner has stated that in applying the test he will interpret substantially similar as meaning equal to or superior to the federal law in the degree and quality of privacy protection. The federal law is the threshold or floor. A provincial/ territorial law must be at least as good, or it is not substantially similar.

What is the role of the provincial/territorial privacy commissioners and other public agencies?

Provincial/territorial commissioners could make their views known by responding directly to the Canada Gazette notice, or through the Office of the Privacy Commissioner of Canada, as well as through internal consultations and communications with their respective provincial/territorial governments.

Evaluation Issues

Which specific requirements will be considered by the Minister of Industry in formulating the recommendation to the Governor in Council pursuant to paragraph 26(2)(b)?

The phrase “substantially similar” is used in at least 27 federal statutes. In the Public Service Superannuation Act, for example, the term is used to define a substantially similar provincial law as “a law of a province that, in the opinion of the Minister, is substantially similar to the Pension Benefits Standards Act, 1985.” By making use of the term “substantially similar” in the PIPEDA, the legislation affords provinces/territories the flexibility to adapt and tailor their own private sector legislation to the specific needs and conditions of their jurisdiction while meeting the intent of the Act. The former Minister of Industry told the Standing Senate Committee on Social Affairs, Science and Technology on December 2, 1999, “We are really looking for similar principles …. We are looking for independent oversight and we are looking for redress for individuals. We are not trying to prescribe in detail what provinces need to do” and later, “We are setting the general standard, and the provinces can legislate around it.”

Substantially similar provincial/territorial legislation will be expected to:

• incorporate the ten principles in Schedule 1 (section 5) of the PIPEDA, principles set out in the National Standard of Canada entitled Model Code for the Protection of Personal Information, CAN/CSA-QQ830-96. The principles are accountability, identifying purposes, consent, limiting collection, limiting use, disclosure, and retention, accuracy, safeguards, openness, individual access, and challenging compliance. These principles represent a well-established consensus on what is necessary to protect privacy in the contemporary social and technological environment. The ten principles are interrelated, make reference to one another and should be read together. They do not have to be enumerate distinctly and separately in substantially similar legislation — what is important is that they all be represented. Special emphasis will be placed on the principles of consent, access and correction rights.
• provide for an independent and effective oversight and redress mechanism with powers to investigate. The effective enforcement of privacy protection and recourse for individuals who believe that their personal information has been misused are both essential to sound privacy legislation.
• restrict the collection, use and disclosure of personal information to purposes that are appropriate or legitimate. The PIPEDA restricts organizations to the collection, use or disclosure of personal information only for purposes that a reasonable person would consider appropriate in the circumstances. Quebec’s private sector privacy legislation (Act Respecting the Protection of Personal Information in the Private Sector) uses the phrase “for a serious and legitimate reason.” Such a provision is meant to ensure that an individual can challenge illegitimate, unreasonable or inappropriate collections, uses, disclosures of their information. Substantially similar legislation will include some reference to the reasonableness and appropriateness of the purposes for which it authorizes the collection, use or disclosure of personal information.

Interested persons are invited to submit comments with respect to the proposed process for the determination of substantially similar legislation within 30 days of the date of publication of this notice. All submissions should cite the Canada Gazette, Part I, the date of publication of this notice and be addressed to Richard Simpson, Director General, Electronic Commerce Branch, Industry Canada, 300 Slater Street, Room D2090, Ottawa, Ontario K1A 0C8. Comments can also be provided by facsimile at (613) 941-0178 or by electronic mail at simpson.richard@ic.gc.ca.

[38-1-o]