Bill C-11, the Digital Charter Implementation Act, was introduced today directed to a new privacy regime, including the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and replacing parts of PIPEDA. Key features include a tribunal that can impose significant fines, order-making power by the Privacy Commissioner, disclosure of “automated decision systems”, data mobility and de-identification uses.
From the government press release:
If passed, the DCIA would significantly increase protections to Canadians’ personal information by giving Canadians more control and greater transparency when companies handle their personal information. The DCIA would also provide significant new consequences for non-compliance with the law, including steep fines for violations.
Some commentary:
In parallel with this legislation, the government has announced a consultation on the Privacy Act that applies to public-sector organizations. The consultation is open until January 17, 2021.
Canadians are invited to share their views on key issues, such as the rules on when federal institutions can collect personal information, how they can use the information entrusted to them, when they can share it with other federal institutions, and the right of individuals to access personal information held by federal institutions. Participants are also being asked to consider oversight and enforcement models under the Act.