The Federal government has introduced a Bill proposing significant change to the national framework for the protection of personal information in Canada.

The long-awaited and much-anticipated Bill, entitled the Digital Charter Implementation Act, 2020 (DCIA), was tabled by the Minister of Innovation, Science, and Industry in Parliament today. If passed, the Bill would establish a new private sector privacy law in Canada, the Consumer Privacy Protection Act (CPPA), and a new Personal Information and Data Protection Tribunal.

Based on the Government of Canada's Fact Sheet, released today, key changes to the federal privacy legislative framework will include the following:

  • Administrative monetary penalties of up to 3% of global revenue or $10 million CAD for non-compliant organizations.
  • Expanded range of offences for certain serious contraventions of the law, subject to a maximum fine of 5% of global revenue or $25 million CAD.
  • Establishing a Personal Information and Data Protection Tribunal.
  • Providing the Privacy Commissioner of Canada with broad order-making powers.
  • Enabling organizations to request the Privacy Commissioner to approve codes of practice and certification systems that set out rules for how the CPPA could apply to certain activities, sectors or business models, and demonstrating compliance.
  • Simplifying consent by removing the burden of having to obtain consent when that consent does not provide any meaningful privacy protection.
  • Allowing individuals to request disposal of their personal information and permit individuals to withdraw consent to the use of their information.
  • Introducing new algorithmic transparency provisions that would provide individuals the right to request that businesses explain how a prediction, recommendation or decision was made by an automated decision-making system and explain how the information was obtained.
  • Granting individuals data mobility rights by allowing them to direct the transfer of their personal information from one organization to another.
  • Allowing de-identified information to be used without an individual's consent in certain circumstances. The legislation would also allow businesses to disclose de-identified data to public entities in certain circumstances for socially beneficial purposes ("data for good").

AccessPrivacy by Osler will be holding a series of events and providing commentary to help keep you up-to-date on the latest developments.

Upcoming events

Webinar - Thursday, November 18, 2020

Register for a special 1-hour AccessPrivacy Webinar this Friday, November 20, 2020 at 3:00 p.m. EST for an initial commentary on key features of the proposed new federal privacy rules.

Monthly AccessPrivacy Call - Wednesday, November 25, 2020

Join us for our upcoming Monthly AccessPrivacy Call on Wednesday, November 25, 2020 for an in-depth analysis of the key features of the proposed federal private sector framework. To register for the call, create a free AccessPrivacy account and then click on the Events Tab to sign up.

AccessPrivacy will also be providing an initial written briefing of the Bill, which you will receive a copy of automatically.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.