1. Reflections on PIPEDA and the Future of Privacy Law in Canada
Kate Wilson, Legal Counsel
Office of the Privacy Commissioner of Canada
McGill University, Faculty of Law
November 27, 2018

2. Privacy Commissioner of Canada
Mandate covers Privacy Act and PIPEDA
Commissioner’s overarching goal of enhancing Canadians’ control over their personal information

3. OPC strategic privacy priorities
Economics of personal information
Government surveillance
Reputation and privacy
The body as information

4. PIPEDA, 17 years on…
Constitutional underpinnings: “trade and commerce” (s.91(2))
Quasi-constitutional status
Human rights legislation?
Consumer protection?

5. Parallel evolution of common law
Statutory torts in various provinces (e.g., British Columbia)
Increasing recognition of torts at common law (e.g., intrusion upon seclusion post Jones v. Tsige in Ontario)
Increase in class action activity and in certification of class actions, particularly post breach

7. 2001: bricks and mortar Bilateral relationship: customer + business
Collection of PI at time of purchase of product or service (e.g., opening a bank account)

8. 2018: virtual ecosystems Complex data-driven business models
Opaque data flows and processes
Frequently transborder nature of data flows

10. Pressures on privacy protection
Big data
Artificial intelligence
Internet of things
Algorithmic decision-making
Cloud computing

11. International developments
General Data Protection Regulation
May 25, 2018
Broad extra-territorial reach
Significant consequences for non-compliance

12. GDPR: new elements
In addition to differences already present under the Directive:
Right to data portability
Right to erasure
Privacy by design and default

13. GDPR: Adequacy
Role of Innovation, Science and Economic Development (ISED)
Adequate but not identical
Impetus for legislative action?

14. Consent under PIPEDA Remains a cornerstone of the Act
How to strengthen?
When is it impracticable? Illusory?
Are there alternatives?

15. Valid consent
s. 6.1: « …the consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure to which they are consenting »

16. Challenges to meaningful consent
Can the individual understand who is making what use of her PI?
Continuous collection, use or disclosure (e.g., IoT)
« Take it or leave it » -- contracts of adhesion?

17. An industry perspective
Consent is impracticable for certain unanticipated uses of data
Increase reliance on implied consent as a means of facilitating innovation
Promote de-identification
Consider a risk-based consent model
Broaden the concept of « publicly available »

18. Guidelines for obtaining meaningful consent
Guidance takes effect January 1, 2019
Consent consultation process
Further clarifies how organizations achieve valid/meaningful consent

19. 7 principles for meaningful consent
Emphasize key elements (4)
Allow individuals to control level of detail and timing
Provide clear options for yes or no
Be innovative and creative
Consider the consumer’s perspective
Make consent a dynamic and ongoing process
Be accountable: be ready to demonstrate compliance

20. Exploring other avenues for protection and control
Legitimate interests
Ethical assessment of data processing
Promoting algorithmic transparency
De-identification of personal information

21. Reputation
Draft position paper on online reputation: to what extent does PIPEDA already speak to these issues?
Identification of inappropriate practice of posting information in order to then charge to take it down (e.g., Globe24h.com)
Federal Court reference re whether Google’s search engine service subject to PIPEDA

22. Updating the OPC enforcement tool kit
Ombudsmodel, pros and cons
Order-making powers
Administrative monetary penalties
Not new ‘asks’

23. In the interim at the OPC…
Restructuring : promotion and compliance sectors
Encouraging compliance v. dealing with existing compliance issues
Shift towards pro-active enforcement
Emphasis on guidance in key areas
Development of Business Advisory Services

24. Learn more at www.priv.gc.ca