CANADIAN PRIVACY REGULATIONS
The CPPA ’ s purpose statement sets two fundamental priorities : ensuring effective privacy protection for consumers and enabling Canadians to enjoy the enormous social and economic benefits of private sector data use .
The CPPA has preserved two of PIPE- DA ’ s key strengths : both laws are principles-based and technology-neutral , with rules that apply evenly across all processing activities . This approach is critical to ensure that the law remains flexible in the face of rapidly evolving technologies and business models for years to come .
There are several important differences between the two laws . For example :
• The CPPA contains a meaningful enforcement model backed by broad order-making powers for the privacy commissioner and the strongest financial penalties in the G7 , while maintaining a focus on early resolution and constructive engagement with businesses . Under PIPEDA , the commissioner can undertake investigations and issue findings , but can neither compel an organization to change its behavior nor impose penalties .
• The CPPA introduces a series of new consumer rights that build on existing rights to access and correct their data , and to withdraw their consent . Consumers would be able to move their information from one organization to another ( under approved data mobility frameworks ) and to request that their information be disposed of when it is no longer appropriate or necessary .
• Organizations would need to comply with greater transparency requirements with respect to their handling of personal information , and with respect to any automated decisions , predictions , or recommendations that may have a significant impact on individuals .
The bill reflects years of extensive consultation with a wide range of stakeholders . It was designed to bolster privacy protections for consumers while fostering innovation in the digital economy .
42 CONTACT CENTER PIPELINE
For Canadian consumers , the CPPA would provide a host of new rights , including :
• A new right for consumers to request that their data be deleted .
• A new right to request that data be ported from one organization to another ( subject to an approved “ data mobility ” framework ).
• A new right to expect companies to provide clearer information about how their data is collected , used and shared for automated decision-making .
• A new right to seek compensation from the courts for various violations .
• Special protections for minors ’ data .
In addition , consumers would benefit from a meaningful enforcement model backed by broad order-making powers for the privacy commissioner and the strongest financial penalties in the G7 .
CONSUMERS WOULD BE ABLE TO MOVE THEIR DATA FROM ONE ORGANIZATION TO ANOTHER ...
WHERE C-27 STANDS
Between September 2023 and April 2024 , Parliament ’ s Industry Committee , which is studying the bill , heard testimony from 131 witnesses – including the Canadian Marketing Association ( CMA ) – one of only three national Canadian business associations that were invited to participate .
The members of Parliament ( MPs ) on the Industry Committee then filed close to 200 amendments . They began debating the amendments in April 2024 . To date , they have completed their deliberations on only 10 of the amendments ( summarized in CHART 1 ).
Just as in the U . S ., it can take a long time for a bill to become law . This is due to many factors , including the complexity of the bill , the legislative calendar , the political climate , and the urgency of the bill .
BILL C-27 MILESTONES AND STEPS THAT LIE AHEAD
• June 16 , 2022 : First Reading in the House of Commons .
• November 4 , 2022 : Second Reading in the House of Commons .
• September 2023 – February 2024 : Consideration in Committee .
• April 8 , 2024 : Industry Committee begins debating amendments to the bill . Votes on 9 of close to 200 amendments before beginning their summer recess .
STILL TO COME
• Industry Committee report back to the House of Commons .
• Third reading in the House of Commons .
• First and second reading in the Senate , referral to a Senate committee , completion of the Senate committee ’ s report followed by third reading in the Senate .
• Review in the House of Commons of any amendments made by the Senate .
WHAT HAS CHANGED SO FAR ?
Amendments that have been passed to date include :
• Defining the age of a minor ( an individual under 18 years of age ).
• Amending the definition of personal information ( to include inferred information ).
• Amending the definition of sensitive personal information to include any information about an individual , for which , the individual generally has a high expectation of privacy . Which may include information such as racial or ethnic origin , sexual orientation , financial data , and geolocation data . See the following for more details .