Reflections on PIPEDA and the Future of Privacy Law in Canada Kate Wilson, Legal Counsel Office of the Privacy Commissioner of Canada McGill University, Faculty of Law November 27, 2018

Privacy Commissioner of Canada Mandate covers Privacy Act and PIPEDA Commissioner’s overarching goal of enhancing Canadians’ control over their personal information

OPC strategic privacy priorities Economics of personal information Government surveillance Reputation and privacy The body as information

PIPEDA, 17 years on… Constitutional underpinnings: “trade and commerce” (s.91(2)) Quasi-constitutional status Human rights legislation? Consumer protection?

Parallel evolution of common law Statutory torts in various provinces (e.g., British Columbia) Increasing recognition of torts at common law (e.g., intrusion upon seclusion post Jones v. Tsige in Ontario) Increase in class action activity and in certification of class actions, particularly post breach

2001: bricks and mortar Bilateral relationship: customer + business Collection of PI at time of purchase of product or service (e.g., opening a bank account)

2018: virtual ecosystems Complex data-driven business models Opaque data flows and processes Frequently transborder nature of data flows

Pressures on privacy protection Big data Artificial intelligence Internet of things Algorithmic decision-making Cloud computing

International developments General Data Protection Regulation May 25, 2018 Broad extra-territorial reach Significant consequences for non-compliance

GDPR: new elements In addition to differences already present under the Directive: Right to data portability Right to erasure Privacy by design and default

GDPR: Adequacy Role of Innovation, Science and Economic Development (ISED) Adequate but not identical Impetus for legislative action?

Consent under PIPEDA Remains a cornerstone of the Act How to strengthen? When is it impracticable? Illusory? Are there alternatives?

Valid consent s. 6.1: « …the consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure to which they are consenting »

Challenges to meaningful consent Can the individual understand who is making what use of her PI? Continuous collection, use or disclosure (e.g., IoT) « Take it or leave it » -- contracts of adhesion?

An industry perspective Consent is impracticable for certain unanticipated uses of data Increase reliance on implied consent as a means of facilitating innovation Promote de-identification Consider a risk-based consent model Broaden the concept of « publicly available »

Guidelines for obtaining meaningful consent Guidance takes effect January 1, 2019 Consent consultation process Further clarifies how organizations achieve valid/meaningful consent

7 principles for meaningful consent Emphasize key elements (4) Allow individuals to control level of detail and timing Provide clear options for yes or no Be innovative and creative Consider the consumer’s perspective Make consent a dynamic and ongoing process Be accountable: be ready to demonstrate compliance

Exploring other avenues for protection and control Legitimate interests Ethical assessment of data processing Promoting algorithmic transparency De-identification of personal information

Reputation Draft position paper on online reputation: to what extent does PIPEDA already speak to these issues? Identification of inappropriate practice of posting information in order to then charge to take it down (e.g., Globe24h.com) Federal Court reference re whether Google’s search engine service subject to PIPEDA

Updating the OPC enforcement tool kit Ombudsmodel, pros and cons Order-making powers Administrative monetary penalties Not new ‘asks’

In the interim at the OPC… Restructuring : promotion and compliance sectors Encouraging compliance v. dealing with existing compliance issues Shift towards pro-active enforcement Emphasis on guidance in key areas Development of Business Advisory Services

Learn more at www.priv.gc.ca