Skip to content

Digital Charter Implementation Act, 2020: The long-awaited overhaul of private sector privacy legislation in Canada

Koren Thomson and Sarah Byrne

On November 17, 2020, the Digital Charter Implementation Act, 2020 (“Act”) was introduced as Bill C-11. This is the first major update to the federal private sector privacy regime in Canada since the implementation of the Personal Information Protection and Electronic Documents Act (“PIPEDA”) in 2000. Bill C-11 seeks to enact two new pieces of legislation: the Consumer Privacy Protection Act (“CPPA”) and the Personal Information and Data Protection Tribunal Act (“PIDPTA”). It also repeals Part 1 of PIPEDA, which will be renamed the Electronic Documents Act.

Consumer Privacy Protection Act

The CPPA will replace Part 1 of PIPEDA, and govern the protection of personal information that organizations collect, use or disclose in the course of commercial activities. Highlights include:

  • Enhanced accountability: Private-sector organizations are required to implement a privacy management program which outlines policies, practices, and procedures to ensure compliance with CPPA, and provide access to the documents created under the program upon request by the Federal Privacy Commissioner.
  • Codification of consent requirements: The CPPA codifies and updates the consent requirements for the collection, use and disclosure of personal information. For instance, the CPPA sets out four components of valid consent, namely a requirement to inform an individual in plain language: the purposes for the collection, use and disclosure of the personal information (which have recording requirements); (b) the ways in which the information is to be collected, used or disclosed; (c) any reasonably foreseeable consequences of the collection, use or disclosure; (d) the specific type of information to be collected, used or disclosed; and, (e) the names or types of third parties to which the information may be disclosed.
  • Modernized information and access provisions: Upon request, organizations must inform individuals of whether it has personal information about them, how it uses the information, whether it has disclosed the information and to whom, and provide the individual access to the information. Organizations that use automated decision systems to make predictions, recommendations or decisions about an individual are also required, upon request, to explain how the system made the prediction, recommendation or decision about an individual and how the individuals’ personal information was used to do so. There are statutorily imposed deadlines for responding.
  • Updated prospective business transaction provisions: Organizations party to a prospective business transaction for which they will use and disclose personal information without knowledge and consent, in addition to the current PIPEDA requirements, will also be required to de-identify the personal information before it is used or disclosed and keep it de-identified until the transaction is completed. The organizations are also statutorily obligated to comply with the agreement currently mandated under PIPEDA.
  • Real consequences for non-compliance: The Federal Privacy Commissioner is empowered to conduct inquiries, order organizations to comply with the Act, and for certain contraventions may recommend to the new Personal Information and Data Protection Tribunal that it impose a financial penalty. The Tribunal can order a penalty based on the Commissioner’s decision or its own decision on appeal. The maximum penalty is the higher of $10,000,000 or 3% of the organization’s gross global revenue in its previous financial year.
  • A private right of action: The CPPA also creates an independent, private right of action for individuals who suffer damage due to contraventions of CPPA where there have been adverse findings against the organization by the Commissioner or the Tribunal, or there has been a conviction for an offence. As a result, breach of the CPPA may result not only in an administrative penalty, but also a civil action, upping the stakes for organizations who fail to comply.

Personal Information and Data Protection Tribunal Act

The PIDPTA should be read in concert with the CPPA. In short, the PIDPTA:

  • Creates the Tribunal: The PIDPTA creates the Personal Information and Data Protection Tribunal to hear appeals of decisions made by the Federal Privacy Commissioner and to impose penalties for certain contraventions of the CPPA.
  • Rules and procedures: The Tribunal is empowered, with approval from the Governor in Council, to make rules that are not inconsistent with the Act or the CPPA to govern its practice and procedure. Note that a civil standard of proof is statutorily imposed, but that the Tribunal is “not bound by any legal or technical rules of evidence in conducting a hearing”, and is required to deal with all matters before it “as informally and expeditiously as the circumstances and considerations of fairness and natural justice permit”.
  • Method of review: The Tribunal must provide written decisions with reasons, which must be made available to the public. All decisions of the Tribunal are to be final and binding, subject only to judicial review under the Federal Courts Act.

Stewart McKelvey will continue to monitor the progress of Bill C-11, and to keep organizations informed of their new obligations. In the meantime, please contact our Privacy group should you require further information or assistance.


This article is provided for general information only. If you have any questions about the above, please contact a member of our Privacy group.

Click here to subscribe to Stewart McKelvey Thought Leadership articles and updates.

SHARE

Archive

Search Archive


Search
Generic filters

 
 

The Winds of Change (Part 4): A Review of Rental and Royalty Regimes for Wind Development on Crown Lands: Options for Newfoundland and Labrador’s Economic Wind Policy

August 3, 2022

By: John Samms, Sadira Jan, Paul Kiley, Dave Randell, Alanna Waberski, and Jayna Green As we explained in our July 6, 2022 “Winds of Change” article, the announcement made by Minister Andrew Parsons on April…

Read More

Update on the Economic Mobility Program for Refugees (phase 2): The Economic Mobility Pathways Project (“EMPP”)

August 2, 2022

Included in Beyond the Border – July 2022 By Brittany Trafford; Fredericton   Brief Overview In an attempt to address the Canadian labour market shortages, the Economic Mobility Pathways Pilot (“EMPP”), was introduced in 2018.…

Read More

HR Best Practices When Employing Foreign Workers

July 29, 2022

Included in Beyond the Border – July 2022   By Brendan Sheridan; Halifax Canadian employers are increasingly relying on foreign workers to fill gaps in the labour market and to provide specialized skills. In 2020,…

Read More

Beneficial Ownership Registry Rules Come to New Brunswick

July 28, 2022

By Alanna Waberski, Graham Haynes and Maria Cummings On June 10, 2022, the Government of New Brunswick proclaimed into force Bill 95, which amends the Business Corporations Act (New Brunswick) (the “NBBCA”) to require corporations…

Read More

Recent trends in defined benefits pension plans – a review of public sector plans

July 28, 2022

Included in Discovery: Atlantic Education & the Law – Issue 10 Hannah Brison and Dante Manna Increased financial volatility caused by recent global events has caused public sector defined benefit (“DB”) pension plans to reflect…

Read More

Atlantic Canada offers immigration pathways for workers in Trucking, Health, Construction and Food Service Industries

July 27, 2022

Included in Beyond the Border – July 2022 By Sara Espinal Henao; Halifax It is a well-known fact that Atlantic Canada needs workers. In the aftermath of COVID-19, regional employers in the trucking, health, construction,…

Read More

The winds of change (part 3): Newfoundland and Labrador releases wind energy guidelines

July 27, 2022

By: John Samms, Matthew Craig, Dave Randell,  and Jayna Green On July 26, 2022 the Province of Newfoundland and Labrador (the “Province”) released “Guidelines: Nominating Crown Lands for Wind Energy Projects” (the “Guidelines”). Described as…

Read More

Trends in tenure and promotion for unionized employers

July 25, 2022

Included in Discovery: Atlantic Education & the Law – Issue 10 By Kate Profit    Tenure is a well known and often discussed topic amongst academics. Viewed by unions as a cornerstone of modern universities,…

Read More

Car-Sharing Comes to PEI – Insurance Implications

July 22, 2022

Dalton McGuinty Jr. and Kegan Bradley On May 17th, 2022, Canada’s largest car-sharing company, Turo, brought their platform to Prince Edward Island. The service allows car owners (lessors) to lend out their vehicles to drivers…

Read More

Federal Government announces significant investments in Nova Scotian clean energy initiatives

July 21, 2022

Nancy Rubin & Tiegan Scott On July 21, 2022, the Federal government announced a new investment of up to $255 million for clean energy initiatives in Nova Scotia. The funds will be allocated in two…

Read More

Search Archive


Search
Generic filters

Scroll To Top