Privacy Rules Set to Change Across the Provinces

With federal privacy law reform on hold (with Parliament in recess and the likelihood of a fall election), the provinces are forging ahead with their own efforts to reform or introduce private sector privacy laws.

Marketers whose organizations operate in Quebec, B.C., Alberta, and Ontario should take note of the following developments, as these provincial frameworks apply (or would apply, if adopted) to intra-provincial activities.

Here's what you need to know.

Quebec

Last summer, Quebec proposed a major overhaul of its private sector privacy law, the Quebec Privacy Act, through Bill-64. Heavily inspired by the GDPR, the bill proposes significant new fines and enforcement, new data rights for consumers, and stringent consent and transparency requirements.

A committee of the Quebec National Assembly was tasked with reviewing the bill, and the CMA filed a submission last fall. The committee has been reviewing each section of the bill and making several key amendments. Their work is on hold for the summer and expected to resume in the fall.

The marketing community supports some of the amendments, including a proposed ability to use personal information without consent when it is necessary to deliver a product or service.

Other amendments would hamper marketing activities, most notably a new requirement for organizations to deactivate "by default" (and require express consent for) technologies that identify, locate or profile a person when they are used to collect personal information. It is unclear whether this requirement would apply to the use of online tracking tools (cookies, beacons, pixels etc.) for marketing purposes. If so, this shift from an opt-out to an opt-in model would have serious implications for digital advertising.

The bill is expected to be adopted by December 2021. Most of its provisions would take effect one year after its adoption, potentially in the last two quarters of 2022.

British Columbia

In the Spring, B.C. re-opened its own consultation (originally struck last summer) to reform its private sector privacy law, the Personal Information Protection Act (PIPA). The CMA provided a submission in late July.

A Special Committee of the B.C. Legislative Assembly will review the feedback and present recommendations on how the law should be amended by December of this year. Although timing is uncertain, we could potentially see a draft bill sometime in 2022.

Alberta

Alberta has followed suit with its own consultation on improving private sector privacy protections through its Personal Information Protection Act (PIPA). This initial consultation is a short one (open for one month ending August 20). 

Individuals and organizations are being asked to provide their feedback through a short survey or a submission. The CMA will provide detailed feedback. 

We expect further details and consultations in the coming months.

Ontario

Last fall, the Ontario government consulted on the possibility of bringing a private sector privacy law to Ontario for the first time. The CMA provided a submission in October 2020, urging the province to continue to rely on federal privacy law for privacy protection, legislating only in areas that a reformed federal law won’t cover, such as certain non-commercial activities.

In light of the federal government’s Bill C-11, the consultation was restruck this summer with a deadline of September 3. Organizations are being asked to respond to detailed proposals put forward in a whitepaper, which leans on the federal bill as a comparison point for which approach to take.

The CMA is urging all provincial governments to wait for the next iteration of federal legislation before proceeding with any new private sector privacy legislation, including modifications to current rules.

Although privacy laws are due for an update, the risk of regulatory disarray in Canada is real and would be detrimental for marketers and consumers alike.

The CMA is actively engaged with provincial governments to advocate for coordination of privacy rules across the country.

Marketers are encouraged to provide any feedback they may have on the consultations underway to Fiona Wilson, the CMA’s Director, Government Relations.

Keep in Touch and Stay informed

With privacy developments moving quickly, you can rely on the CMA to keep you up to date. Be sure to check out our privacy law reform webpage for the latest updates, and for information on privacy compliance and best practices, head to the CMA’s privacy protection webpage.