Canada: Special Committee Begins Consultations On Changes To BC's Personal Information Protection Act

On February 18, 2020, the Legislative Assembly of British Columbia appointed a Special Committee to conduct a review of British Columbia's private and not-for-profit sector privacy legislation: the Personal Information Protection Act ("PIPA"). The Special Committee will be holding public hearings via tele/videoconference on June 3, 5, 9, 10, 12 and 16, 2020 as part of its review, inviting British Columbians to share their views on how PIPA is – or is not – working for them or their organizations.

As part of its review, the Special Committee is likely to consider whether to align PIPA with other provincial and federal privacy legislation by requiring organizations to notify the Office of the Information and Privacy Commissioner of British Columbia ("OIPC") and affected individuals of data breaches that pose a real risk of significant harm to the affected individuals. The Special Committee is also likely to consider enforcement measures, such as the OIPC's power to impose fines for violations of PIPA.

Another consideration will be how much an amended PIPA should resemble the European Union's General Data Protection Regulation. PIPA does not currently have an 'adequacy decision' by the European Commission, unlike its federal counterpart, the Personal Information Protection and Electronic Documents Act. An 'adequacy decision' would simplify the process for transferring personal data from the European Union to private and not-for profit organizations in British Columbia that are subject to PIPA.

The Special Committee anticipates issuing the findings of its review in a report in February of 2021. Additional information on the public hearings, including how to participate and make submissions to the Special Committee can be found at: https://www.leg.bc.ca/parliamentary-business/committees/41stParliament-5thSession-pipa.

For more information about PIPA or any other Canadian privacy laws, please contact the authors and see our Cybersecurity, Privacy & Data Management group page.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.