Download presentation
Presentation is loading. Please wait.
Published byNathan Hines Modified over 6 years ago
1
Reflections on PIPEDA and the Future of Privacy Law in Canada
Kate Wilson, Legal Counsel Office of the Privacy Commissioner of Canada McGill University, Faculty of Law November 27, 2018
2
Privacy Commissioner of Canada
Mandate covers Privacy Act and PIPEDA Commissioner’s overarching goal of enhancing Canadians’ control over their personal information
3
OPC strategic privacy priorities
Economics of personal information Government surveillance Reputation and privacy The body as information
4
PIPEDA, 17 years on… Constitutional underpinnings: “trade and commerce” (s.91(2)) Quasi-constitutional status Human rights legislation? Consumer protection?
5
Parallel evolution of common law
Statutory torts in various provinces (e.g., British Columbia) Increasing recognition of torts at common law (e.g., intrusion upon seclusion post Jones v. Tsige in Ontario) Increase in class action activity and in certification of class actions, particularly post breach
7
2001: bricks and mortar Bilateral relationship: customer + business
Collection of PI at time of purchase of product or service (e.g., opening a bank account)
8
2018: virtual ecosystems Complex data-driven business models
Opaque data flows and processes Frequently transborder nature of data flows
10
Pressures on privacy protection
Big data Artificial intelligence Internet of things Algorithmic decision-making Cloud computing
11
International developments
General Data Protection Regulation May 25, 2018 Broad extra-territorial reach Significant consequences for non-compliance
12
GDPR: new elements In addition to differences already present under the Directive: Right to data portability Right to erasure Privacy by design and default
13
GDPR: Adequacy Role of Innovation, Science and Economic Development (ISED) Adequate but not identical Impetus for legislative action?
14
Consent under PIPEDA Remains a cornerstone of the Act
How to strengthen? When is it impracticable? Illusory? Are there alternatives?
15
Valid consent s. 6.1: « …the consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure to which they are consenting »
16
Challenges to meaningful consent
Can the individual understand who is making what use of her PI? Continuous collection, use or disclosure (e.g., IoT) « Take it or leave it » -- contracts of adhesion?
17
An industry perspective
Consent is impracticable for certain unanticipated uses of data Increase reliance on implied consent as a means of facilitating innovation Promote de-identification Consider a risk-based consent model Broaden the concept of « publicly available »
18
Guidelines for obtaining meaningful consent
Guidance takes effect January 1, 2019 Consent consultation process Further clarifies how organizations achieve valid/meaningful consent
19
7 principles for meaningful consent
Emphasize key elements (4) Allow individuals to control level of detail and timing Provide clear options for yes or no Be innovative and creative Consider the consumer’s perspective Make consent a dynamic and ongoing process Be accountable: be ready to demonstrate compliance
20
Exploring other avenues for protection and control
Legitimate interests Ethical assessment of data processing Promoting algorithmic transparency De-identification of personal information
21
Reputation Draft position paper on online reputation: to what extent does PIPEDA already speak to these issues? Identification of inappropriate practice of posting information in order to then charge to take it down (e.g., Globe24h.com) Federal Court reference re whether Google’s search engine service subject to PIPEDA
22
Updating the OPC enforcement tool kit
Ombudsmodel, pros and cons Order-making powers Administrative monetary penalties Not new ‘asks’
23
In the interim at the OPC…
Restructuring : promotion and compliance sectors Encouraging compliance v. dealing with existing compliance issues Shift towards pro-active enforcement Emphasis on guidance in key areas Development of Business Advisory Services
24
Learn more at www.priv.gc.ca
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.