Skip to content

Privacy practice tune-up – getting ready for the Consumer Privacy Protection Act

Rob Aske

As we wrote about earlier, Canada’s federal government has proposed a replacement to our national privacy law for commercial transactions known as the Personal Information Protection and Electronic Documents Act (“PIPEDA”).

The new bill is the Digital Charter Implementation Act, and this bill in turn would create a new Consumer Privacy Protection Act (“CPPA”) which would replace the privacy portion of PIPEDA.

The CPPA will likely not come into force for a year or more, while consultations and the drafting of regulations proceed.

However, the proposed CPPA does restate and expand on the existing privacy law requirements of PIPEDA, and if your business needs a privacy tune-up then CPPA can provide a useful guide, with better detail than PIPEDA offers now.

Privacy management program

For example, CPPA requires all organizations (including businesses) to implement a “privacy management program” including policies, practices and procedures for protection of personal information, complaints handling, training of personnel and for explaining these practices to the public. This program must take into account the “volume and sensitivity of the personal information” under the organization’s control.

CPPA also obliges an organization to provide the federal Privacy Commissioner with access to all policies, practices and procedures of its privacy management program, merely upon request, which of course could give the Commissioner a good look into any program gaps. If the Commissioner has reasonable grounds to believe that a breach of privacy obligations has occurred, then the Commissioner may choose to “audit” these practices.

Further detail on consent

The required consent for use of personal information is also described in CPPA in greater detail, and states that consent is only valid if at or before the time that the organization seeks the individual’s consent, it provides the following information in “plain language”:

(a) the purposes for the collection, use or disclosure;

(b) the way in which the personal information is to be collected, used or disclosed;

(c) any reasonably foreseeable consequences of the collection, use or disclosure of the personal information;

(d) the specific type of personal information that is to be collected, used or disclosed; and

(e) the names of any third parties or types of third parties to which the organization may disclose the personal information.

Consent must be obtained at or before collection, and must be express unless it is appropriate to rely on implied consent, taking into account the reasonable expectations of the individual and the sensitivity of the personal information.

Plain language privacy policies

CPPA also gives clearer guidance on privacy policies to be made available to customers and others providing personal information, which must again be in “plain language” and include at least the following:

(a) a description of the type of personal information under the organization’s control;

(b) a general account of how the organization makes use of personal information, including how the organization applies any permitted exceptions;

(c) a general account of the organization’s use of any automated decision system (e.g. AI systems) to make predictions, recommendations or decisions about individuals that could have significant impacts on them;

(d) whether or not the organization carries out any international or interprovincial transfer or disclosure of personal information that may have reasonably foreseeable privacy implications;

(e) how an individual may make a request for disposal or access; and

(f) the business contact information for your privacy officer.

While the policy requirements above about automated decision systems and international and interprovincial transfers are part of many policies now, they are new as express requirements of the law.

Therefore, all businesses that may be considering a tune-up of their privacy practices and policies should review the standards as outlined in the proposed CPPA, including those above.


This article is provided for general information only. If you have any questions about the above, please contact a member of our Privacy group.

Click here to subscribe to Stewart McKelvey Thought Leadership articles and updates.

SHARE

Archive

Search Archive


 
 

IRCC expands authorization for foreign workers to study without a study permit: Four things you need to know

July 13, 2023

By Sara Espinal Henao Immigration, Refugees and Citizenship Canada (“IRCC”) has announced a promising new temporary measure that allows foreign workers to study for a longer duration without a study permit, opening the door for…

Read More

Canada’s first-ever Tech Talent Strategy announced

July 12, 2023

By Brendan Sheridan The Government of Canada recently announced a number of aggressive immigration measures to help attract top talent to Canada in high-growth industries in an effort to fuel innovation and drive emerging technologies.…

Read More

ESG and dispute resolution: fighting for greener ways

July 5, 2023

By Daniela Bassan, K.C. All stakeholders in the legal profession, including litigators, have a shared interest in promoting environmental, social, and governance (ESG) pathways towards building a greener society. It is crucial for litigators to…

Read More

Amendments to the Canada Business Corporations Act affecting registers of individuals with significant control

June 30, 2023

By Kimberly Bungay and Colton Smith Since June of 2019, corporations formed under the Canada Business Corporations Act have been required to prepare and maintain a register of individuals with significant control (an “ISC Register”).…

Read More

Navigating the waters: Compliance with multiple regimes

June 22, 2023

By Kim Walsh and Olivia Bungay Compliance with Russian sanctions goes beyond complying with Canada’s Russia Regulations. Canadian individuals and businesses may be unaware of several other sanctions regimes that apply to them. In conjunction…

Read More

Nova Scotia releases offshore wind roadmap

June 21, 2023

By David Randell, Robert Grant, K.C., Sadira Jan, and James Gamblin On June 14, 2023, the Province of Nova Scotia released the first of three modules (the “Module”) which will comprise the Nova Scotia Offshore…

Read More

Board, Bye!: Changes to the Municipal Appeal Process under the Urban and Rural Planning Act, 2000

June 19, 2023

By: Joe Thorne, Giles Ayers, and Jayna Green Introduction Prior to June 1, 2023, decisions made by municipal town councils in Newfoundland and Labrador could be appealed to one of four Regional Appeal Boards pursuant…

Read More

Navigating Canada’s sanctions against Russia: New guidance on ownership and control of an entity

June 16, 2023

By Kim Walsh and Olivia Bungay Canadian sanctions targeting Russia in relation to Russia’s ongoing invasion of Ukraine were significantly expanded over the past year. Critical to compliance with Canada’s sanctions targeting Russia, individuals and…

Read More

Navigating Canada’s economic sanctions against Russia

June 6, 2023

By Kim Walsh and Olivia Bungay Canadian sanctions targeting Russia in relation to Russia’s ongoing invasion of Ukraine were significantly expanded over the past year. The Special Economic Measures (Russia) Regulations impose sanctions on individuals…

Read More

Federal Government introduces amendments to expand the mandates of the two historic Atlantic Accord Acts to include offshore wind energy

June 1, 2023

David Randell, Sadira Jan, Robert Grant, K.C., Greg Moores, G. John Samms, and James Gamblin The recent tabling of federal legislation is an important step for offshore wind development in the offshore areas of Nova…

Read More

Search Archive


Scroll To Top