Where art thou, new privacy law?

With Parliament in recess for the summer (enabling MPs to spend time in their ridings), many are speculating about whether Canada’s private sector privacy law will be updated before the next election.

Progress to date has been slow. Between September 2023 and April 2024, Parliament’s Industry Committee, which is studying the bill, heard testimony from 131 witnesses, including the Canadian Marketing Association (CMA) – one of only three national Canadian business associations that were invited to participate. The MPs on the Committee then filed close to 200 amendments – which is a lot! They began debating the amendments in April but so far, they have only completed their deliberations on 10.

What has changed in the bill so far?

Amendments that have been passed to date include defining the age of a minor (an individual under 18 years of age), amending the definition of personal information (to include inferred information), and amending the definition of sensitive personal information (to include any information about an individual, for which the individual generally has a high expectation of privacy, which may include information such as racial or ethnic origin, sexual orientation, financial data, and geolocation data).

An insurmountable hurdle?

The topic being debated when the Committee rose for the summer was whether to accept the bill’s provisions to establish a tribunal. The government’s intended purpose for the tribunal was to have it determine whether any penalties recommended by the privacy commissioner are appropriate, and also to hear appeals of the findings, interim or final orders, and of decisions not to impose any penalties on an organization.

A decision by the Committee to eliminate the tribunal would likely be an insurmountable hurdle because a new enforcement framework would need to be developed, debated, considered by Cabinet, and then introduced. Committee members are far from a consensus on this amendment.

If the tribunal survives, the Committee still has the daunting task of voting on all the remaining amendments, after which the bill would be sent to the House of Commons for third reading. It would then be referred to the Senate, and to a committee of the Senate for study. If the Senate makes any amendments, the House of Commons would have to vote on the bill again.

Time is running out

It’s a challenging journey for any piece of legislation. But to make matters worse, the clock is ticking down rapidly. If the bill is not adopted by the House and the Senate before the next federal election (which must take place on or before October 20, 2025), it will be abandoned. The new government would need to start from scratch and introduce a new bill. It’s unclear how much of a priority privacy law reform will be for the next government, regardless of which party wins the election, particularly if it is a minority government. Newly elected governments typically focus on legislation that fulfills their campaign promises and key policy platforms, such as budget and fiscal policies, housing affordability and healthcare. 

The only way current bill could be adopted before the election is if the political parties agree to expedite the process. Although this is not an impossible scenario, there is currently no clear pathway for it to occur.

What are the implications of no legislation?

In the absence of new legislation, the existing law will continue to govern the collection, use and disclosure of personal information by the private and not-for-profit sectors.

At the same time, we can expect the privacy commissioner to take whatever steps he can to achieve his three strategic priorities: protecting and promoting privacy with maximum impact; addressing and advocating for privacy in this time of technological change; and championing children’s privacy rights.

For example, he could:

• issue new guidance to strengthen the protection of personal information to the extent that PIPEDA permits, and
• increase participation in joint investigations with other privacy regulators within Canada and globally, and also with other Canadian regulators (e.g., the CRTC and Competition Bureau).

We can also expect some provinces to follow Quebec’s lead and establish or update their own privacy laws. Alberta has already launched a consultation, and British Columbia is likely to follow, with other provinces considering when/whether to proceed. This will result in a patchwork of rules that will be difficult for consumers to understand, and difficult and costly for businesses to implement.

What steps is the CMA taking?

The CMA is continuing to speak to policymakers about the proposed amendments to the bill. If the bill overcomes the daunting challenges it is facing and advances through the legislative process, the CMA will continue to stress the importance of ensuring that it achieves its original two purposes: to ensure effective privacy protection for consumers and to enable Canadians to enjoy the enormous social and economic benefits of private sector data use.

In addition, the CMA is actively participating in consultations with several government bodies, including the Office of the Privacy Commissioner, the Competition Bureau, and some provinces on a range of topics including privacy, the protection of minors’ data, AI, consumer protection and more, to foster a legislative and regulatory environment in which businesses can compete effectively and consumers are protected.