Feds make long-overdue start on levelling the playing field on data protection

OTTAWA—A long struggle to give Canadian consumers an assist in their unequal dealings with tech giants got underway last week with the introduction of federal legislation meant to tighten up privacy laws. Bill C-11, which will bring in the Consumer Privacy Protection Act (CPPA), is meant to bring some order to the Wild West of the current digital and data-driven economy. It reflects an effort by lawmakers around the world to come to grips with the ever-increasing marketplace power of digital businesses. Canadians have for years been demanding the federal privacy commissioner be given some teeth to stop information breaches and the improper use of personal data by organizations profiting from online interactions. And the urgency has gained momentum from Canada's sudden conversion to a digital nation as a result of the pandemic. In its latest report, the Canadian Center for Cyber Security said Canadians lost at least $43-million to cybercrime fraud in 2019 and warned the risk of misuse of personal data is accelerating, along with increased online living patterns: “As Canadians generate, store, and share more personal information online, this data becomes vulnerable to cyber threat actors via breaches or misuse by the companies or foreign governments that collect it.” In the first year that Canadian companies were compelled to report information breaches, the privacy commissioner received six times as many reports as in the previous year—in all, 680 data breach reports over 12 months up to Nov. 1, 2019, affecting 28-million Canadians. Bill C-11 is a wide-ranging legislative package that will, if passed, improve consumers’ rights as they use digital platforms and services. The CPPA would, among other things, give the privacy commissioner the power for the first time to force organizations to comply with privacy laws and recommend that a new administrative tribunal levy fines on non-compliant companies. Any businesses collecting individuals’ data would be subject to new requirements for obtaining individuals’ consent, allowing consumers to demand an organization delete their personal information and explain how a platform used AI to make a recommendation. This momentous legislation seeks to get a handle on some of the impacts on consumers of the ongoing tech revolution while simultaneously incorporating the well-represented interests of businesses that the government is depending on to propel a viable modern economy. As such, the balance of interests in Bill C-11 remain to be worked out through regulation, practice, litigation, and government determination in the coming years. Among concerns germane to the bill are questions about how long it will take to get it passed, develop regulations, and begin enforcement. The European Union’s world-leading General Data Protection Regulation (GDPR), while considered an overall success, has been plagued by slow adoption of enforcement mechanisms against dominant multinationals. For instance, Ireland, which as host of the regional headquarters of Facebook, Apple, Google, and Twitter, plays a key regulatory role under the GDPR, did not issue a major decision against any of the tech giants in the first two years of the EU’s data protection regime. There is also the matter of funding Ottawa’s proposed new administrative capacities. Federal officials said last week Ottawa would find the money, but the ongoing costs could be substantial. While the EU population is much greater than Canada’s, it’s worth noting that citizens and privacy groups filed 144,000 GDPR complaints in its first year of operation. With regard to personnel, data protection agencies handling GDPR across the 27-country bloc increased staff over several years by 42 per cent and budgets by 49 per cent, with more needed in some countries. Also unknown is whether the new administrative tribunal tasked with approving fines for non-compliance recommended by the privacy commissioner will function effectively or turn out to be a bottleneck. And, as is often the case in Canada, there are concerns about the emergence of a patchwork of federal rules versus those in Quebec, British Columbia, Alberta, and, soon, Ontario. Under the CPPA, these provinces would be exempted from federal data protection rules with regard to data used in that province, but not for interprovincial or international data transfers—a distinction not likely to make life easy for business. As for consumers, only time will tell how much difficulty and confusion they will encounter in trying to deal personally with online platforms on issues of consent, data transfers, or requests to delete personal information. Ditto for the proposed new right of consumers to launch suits for privacy violations against companies judged to be in non-compliance. But the most controversial aspects of the CPPA are likely to be two provisions: One which allows organizations to disclose de-identified data to governments for “socially beneficial” purposes, while the other allows businesses to collect and use consumers’ personal information without consent for certain “business activities.” Expect an uproar over these provisions, whose scope is seen by some privacy advocates as way too wide, not unlike the controversy around Sidewalk Labs’ now-scrapped high-tech plans on Toronto’s waterfront. Les Whittington is a regular columnist for The Hill Times. The Hill Times