Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, would create a new federal privacy law and amend several existing Acts. It would repeal Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA), rename the remaining statute the Electronic Documents Act, and give privacy powers to the renamed Digital Safety and Data Protection Commission of Canada. The new Act’s stated goal is to protect privacy while allowing organizations to handle information for purposes a reasonable person would consider appropriate.
Organizations covered by the new Act would have to limit collection, use and disclosure of personal information, explain their purposes, and usually obtain valid consent. The Act also sets out situations where organizations may handle information without consent.
Organizations would have to maintain a privacy program, protect information, respond to people’s requests, report certain serious breaches, and delete information when required. People would gain rights to access and correct their information, request its disposal in some cases, and receive explanations of certain significant automated decisions.
The Digital Safety and Data Protection Commission would oversee the Act. Its Privacy and Consumer Data Division would be part of the Commission, not a separate independent body. The Commissioner could investigate, audit and negotiate compliance agreements; the Commission could review cases, order corrective steps and impose penalties for specified breaches.
The Act would also create a damages claim for people who suffer loss or injury from certain established contraventions, protect some employees who report or refuse to take part in contraventions, and create offences for specified knowing breaches and obstruction.
Other amendments include exceptions for certain disclosures by aircraft operators under foreign law and information handling by railway companies under specified railway laws. A corporation would have to dispose of certain information in its register within a stated period, subject to longer legal retention requirements.
The supplied text says the new Act would start on dates set by order, and not before Part 3 of the bill comes into force. No start date is supplied.
People whose information is handled: If an organization is covered, you could ask whether it holds your information, how it uses it, and who it has disclosed it to. You could request access, correction, or disposal in specified circumstances. Some exceptions apply, and de-identified information (information with direct identifiers removed but some re-identification risk) is treated differently.
People affected by automated decisions: On request, an organization would have to explain certain predictions, recommendations or decisions that could have a legal or similarly significant effect on you, including the information and main factors used. You could make written representations to an employee able to review the decision.
Organizations: Covered organizations would have to document purposes, use safeguards, provide breach reports and notices when the legal threshold is met, and meet access-request deadlines. A qualifying breach must be reported to the Commission and affected people notified unless the law prohibits notice. Some requests must be answered within 30 days; allowed extensions are limited.
Businesses handling information: The Act would permit some uses or disclosures without consent, including specified business activities, investigations, emergencies and certain government requests. A separate “legitimate interest” exception would require a prescribed privacy impact assessment and steps to reduce or address likely harms.
Employees and independent contractors: Employers could not disadvantage a worker for certain good-faith reports, refusals or steps to prevent a contravention. Aircraft operators, railway companies and corporations maintaining the specified register would be affected by the related amendments.
Scope: The proposed Act covers certain commercial handling and employee information connected to federal works, undertakings and businesses. It excludes, among others, government institutions covered by the Privacy Act and organizations acting solely for journalistic, artistic or literary purposes.
No cost estimate is provided in the supplied material.
Organizations would have to fund their own compliance work. In some audits, an organization could be required to pay for a report prepared by a third party approved by the Commissioner.
Penalties for specified contraventions would go to the Receiver General. The maximum total for contraventions found following proceedings related to one investigation would be the greater of $10 million or 3% of the organization’s gross global revenue in the previous financial year.
Separate criminal fines could apply to specified knowing breaches or obstruction: the greater of $25 million or 5% of gross global revenue on indictment, or the greater of $20 million or 4% on summary conviction.
The bill would assign duties and powers to the Commission and require a Privacy and Consumer Data Division with at least two members. No staffing or operating-cost estimate is provided.
The supplied material does not include the full current PIPEDA, so I could not verify the exact differences between the proposed law and the law now in force.
Regulations would supply important details, including requirements for privacy impact assessments, breach records, data mobility and some consent exceptions. Those rules are not provided.
The Act uses “legitimate interest” but the supplied material gives no definition. It also leaves some requirements to be prescribed.
The supplied text gives no commencement dates. Some provisions are described only in incomplete excerpts, including parts of the breach-notification and notice-of-contravention provisions.
It is not clear from the supplied material how the new Act would interact in practice with existing programs or all substantially similar provincial privacy laws.
The bill appears intended to give people clearer rights over their personal information while setting consistent duties for organizations that handle it.
Requiring organizations to record purposes, limit collection, use safeguards and explain certain automated decisions could make their handling of information more accountable.
The bill allows some necessary handling without consent but sets conditions for several exceptions, including a privacy impact assessment and harm-reduction steps for the “legitimate interest” exception.
Investigations, audits, compliance orders and penalties could give the Commission tools to address breaches, while damages claims could offer a remedy to people who suffer loss or injury.
The no-consent exceptions cover many situations, including some business activities, investigations and government disclosures. People may have limited control over handling that falls within those exceptions.
Key details depend on future regulations, and terms such as “legitimate interest” are not defined in the supplied text. That could leave organizations and individuals uncertain about how the rules apply.
The new duties could require substantial compliance work, but the materials give no estimate of business or government costs.
The bill creates significant Commission powers, including audits and large penalties, while the supplied excerpts do not show every procedural detail or the full text of some provisions.