Expert insights into Canada’s changing privacy and AI rules

2022 CMAprivacy recap

More than 160 people tuned into our annual CMAprivacy event to hear from top marketing and privacy experts on the future of privacy and AI in Canada.

This year’s event featured special keynote remarks from the Hon. François-Phillipe Champagne, Canada’s Minister of Innovation, Science and Industry, who shed light on the government’s plan to modernize privacy protections and enhance trust in the digital marketplace through Bill C-27.

“As marketers you are at the forefront of helping people find products and services to make their lives better,” said Minister Champagne, “I am convinced that this new framework will enable you to work more effectively, while also upholding important safeguards for Canadians privacy and data.”

See the Minister’s full remarks here and highlights of the panel discussions below.

Canada's Bill C-27 Overhaul

Tabled in June, Bill C-27 aims to modernize federal privacy law through a new Consumer Privacy Protection Act (CPPA), and proposes Canada’s first-ever regulatory framework for AI. As the bill winds its way through the political process, panelists shed some valuable insights on the changes being proposed and what they mean for marketers looking to plan ahead.

Panelists agreed that the CPPA proposes a strong foundation for reform. “The balance and flexibility that we have seen under PIPEDA is currently reflected under this proposed bill,” said Amanda Maltby, Chief Corporate Compliance & Privacy Officer, Canada Post, “It introduces strong and modernized protections for consumers, but it ensures that Canadian businesses and marketers can leverage data and innovate.”

Although some provisions in the bill would require marketers to stay the course, such as the requirement for marketers to obtain consent (whether opt-in or opt-out) for marketing-related activities, other provisions would take some getting used to.

Brand new proposals include enhanced transparency requirements for automated decision systems (including the predictive analytic tools and recommendation engines marketers rely on to deliver a good customer experience), as well as a proposal that all minors’ data be considered sensitive (bringing with it special protections and new rights for minors and parents with respect to that data). The latter, as Amanda Maltby pointed out, may have the side-effect of “organizations collecting more data from minors (than they do currently) to make sure they don ’t fit a certain age threshold in scenarios where age isn’t obvious.”

Provisions old and new would be backed by the highest proposed penalties in the G7. “We would find ourselves in a world where there are real and immediate consequences - or relatively immediate consequences - for non-compliance,” said David Elder, Head of Privacy & Data Protection Group at Stikeman Elliot LLP.  With financial penalties of up to $25 million or 5% of gross global revenues, the stakes would be higher than ever for organizations to get it right.

The panelists went on to discuss the proposed Artificial Intelligence and Data Act (AIDA), which aims to ensure the responsible use of high-impact AI systems across Canada. Although much of the detail of the framework will be left to upcoming consultations and regulations, panelists encouraged marketers to think about AI best practices now. “Coming to discussions like this, speaking to industry professionals, speaking to legal professionals, and doing your own research … is probably the best course of action you can do right now while the legislation is in its infancy,” said Sahil Razdan, Legal Counsel, Postmedia.

To learn more, see the CMA’s overviews of AIDA and the CPPA.

Canadians’ Evolving Views on Data Sharing

The CMA sat down with Erin Kelly, CEO of Advanced Symbolics and creator of Polly, an AI-based market research tool. Using Polly to track the public sentiment of Canadians on social media, Erin Kelly shared a series of insights into how Canadians view data sharing and privacy issues.

According to an analysis by Polly of over 28,000 people, public sentiment and opinion on private sector privacy issues has fluctuated with the news cycle – with concerns peaking during the Cambridge Analytica scandal in 2018 and steadily declining since.

With respect to sentiment on targeted advertising specifically, Polly produced some interesting data. “We are seeing a growing cohort of people saying that they like targeted advertising when it works well,” said Erin Kelly, “and some are saying that they would like to see even better targeting.”

According to Polly, the demand for better targeting is felt most among people in niche or minority communities who feel that their needs are overlooked during mass promotion, such as black women preferring to see makeup shades personalized to them. More individuals, according to Polly, are having the idea that their needs are unique and that they want relevant information that reflect those needs to come to them, rather than having to search for it.

With respect to online privacy concerns, Polly indicated that people were twice as concerned about cybersecurity and data protection than they were about personalization and ad targeting, which was largely attributable to the rise of cybersecurity attacks during the pandemic. The majority of issues raised were related to public sector – rather than private sector - privacy.

Quebec’s Bill-64 countdown

The final CMAprivacy panel discussion unpacked what marketers can expect from Quebec’s new privacy law – otherwise known as Bill-64 - coming into force in stages over the next three years.
Panelists highlighted significant changes to the transparency and consent requirements organizations are used to. With more information being conveyed to consumers, it will be more important than ever for organizations to deliver consumers information in a layered, tailored and understandable way.  “What we know is coming is a lot more information being provided upfront to consumers,” said Pam Snively, Chief Data & Trust Officer at Telus, “And what we also know is that prescribed transparency is a mixed blessing. We need to ensure people have more control over what it is that they're agreeing to....but getting the right information at the right time is very different from getting lots of information all at once.”
As we await official government regulations and guidance in several key areas, panelists noted grey areas within the law. “This creates a situation for organizations where preliminary interpretations of the law may change once the CAI (the Quebec Commission on Access to Information) actually approaches the issue,” said Eloïse Gratton, Partner and National Co-Leader, Privacy and Data Protection, BLG.

New requirements for the use of technologies that use personal information to identify, locate or profile individuals was flagged as one such area that marketers should pay close attention to. Although widely interpreted as a requirement for increased transparency and clearer options for consumers in relation to these technologies, uncertainties still remain as to whether tracking and profiling technologies would have to be deactivated by default, or whether profiling that relies exclusively on personal information that has previously been collected is not subject.

Marketers are encouraged to have early and proactive conversations with their compliance teams, and stay tuned for upcoming CMA guidance.

Keep in touch and stay informed

With privacy developments moving quickly, you can rely on the CMA to keep you up to date. Be sure to check out our privacy law reform webpages for the latest updates, and for information on privacy compliance and best practices, head to the CMA’s privacy protection webpage, or drop us a line.
 
Authors: Fiona Wilson, Director, Public Policy and Chief Privacy Officer, CMA
Gurwinder Sidhu, Public Policy Intern, CMA