Improving Bill C-27, and fighting cyber threats facing Canada

Bill C-27, the Digital Charter Implementation Act, has been recognized by Canada's Privacy Commissioner Philippe Dufresne as a step in the right direction towards protecting Canadians' fundamental privacy rights, and supporting public interest and innovation. The bill has several positive aspects that deserve acknowledgment. Firstly, Bill C-27 introduces new rules and regulations to enhance transparency and accountability in the handling of personal information by organizations. It establishes clear obligations for organizations to inform individuals about the collection, use, and disclosure of their personal data. Secondly, the bill grants individuals greater control over their personal data by giving them the right to request access to their information held by organizations. It also introduces a right to data mobility, allowing individuals to transfer their personal data from one organization to another. These provisions contribute to strengthening individuals' privacy rights, and empowering them to manage their digital identities more effectively. However, there are areas where Bill C-27 can be further improved to modernize this country's privacy law. One key aspect is the need for stronger enforcement powers and penalties for non-compliance. Strengthening the enforcement regime would act as a deterrent and ensure that firms take privacy obligations seriously. Additionally, the privacy commissioner could be given enhanced powers to proactively audit organizations' privacy practices, investigate complaints, and impose penalties for privacy breaches. Another area of improvement involves incorporating more robust consent mechanisms. Consent is a cornerstone of privacy protection, and it is important to ensure that individuals can provide informed consent in a meaningful way. The bill could include provisions to enhance consent mechanisms, such as standardized and simplified consent forms, clear language, and the ability for individuals to easily withdraw consent. Canada faces a range of cyber threats that pose significant risks to its citizens, businesses, and critical infrastructure. These threats include state-sponsored cyber espionage, cybercrime, hacktivism, and malicious cyber activities targeting government institutions, businesses, and individuals. To address these threats and adapt to the new reality of cyber-attacks, the federal government has been actively working on bolstering its cybersecurity measures. Some of the key government initiatives include: • Introducing and updating legislation to address cyber threats and strengthen the legal framework for cybersecurity. The recent passage of the Digital Charter Implementation Act, including provisions for enhanced protection of personal information, is a step towards modernizing privacy and security laws; • Investing in cybersecurity infrastructure, including investments in critical infrastructure protection, threat intelligence capabilities, and the establishment of cybersecurity centres of excellence across the country; and • Actively participating in international collaborations and partnerships to combat cyber threats. Canada works closely with allies and international organizations to share threat data, exchange best practices, and develop coordinated responses to cyber incidents. The poll released by the Office of the Privacy Commissioner of Canada, which revealed that 93 per cent of Canadians expressed some level of concern about the protection of their privacy, underscores the importance of building confidence in privacy rights. Several measures can help address these concerns and enhance privacy rights in this country. Firstly, effective communication and transparency from firms handling personal data are crucial. Organizations should provide clear and easily understandable privacy policies that outline how personal information is collected, used, and protected. This transparency builds trust and empowers individuals to make informed decisions about sharing their data. Secondly, robust enforcement of privacy laws is vital. The privacy commissioner plays a critical role in ensuring compliance and addressing privacy breaches. Strengthening the commissioner's enforcement powers and imposing significant penalties for non-compliance can act as a deterrent and enhance accountability. Education and awareness programs are also essential to inform Canadians about their privacy rights and the steps they can take to protect themselves. Public campaigns, workshops, and educational resources can empower individuals to understand their rights, adopt good privacy practices, and be more discerning about the information they share online. Addressing concerns about privacy rights and their impact on participation in the digital economy requires a comprehensive approach involving government, industry, and civil society. Collaboration among these stakeholders can foster an environment that prioritizes privacy protection while encouraging innovation and economic growth. Dr. Ali Dehghantanha is an academic-entrepreneur in cybersecurity, a Canada Research Chair in Cybersecurity and Threat Intelligence, and an associate professor in Cybersecurity at the University of Guelph. He is the director of a research lab dedicated to advance research and training in cybersecurity, and the director and founder of the Master of Cybersecurity and Threat Intelligence program at the University of Guelph. The Hill Times