Canada introduced new privacy legislation on Monday to regulate the handling of personal information in commercial activities. But concerns have been raised concerning the bill’s expansion of the Digital Safety Commission’s regulatory powers.
The Protecting Privacy and Consumer Data Act, also known as Bill C-36, recognizes privacy as a fundamental right. Companies must obtain valid consent before collecting their consumers’ personal information. This requires companies to disclose the collection’s purposes and consequences in plain language. Companies must also notify consumers what kinds of information they are collecting and if third parties may have access to the information. In addition, customers can request that companies delete their personal information.
Furthermore, the act empowers the new commission and its commissioner to enforce the law, with the commissioner initiating and investigating complaints. Companies must provide their privacy management program to the commission on request.
Evan Solomon, Minister of Artificial Intelligence and Digital Innovation, said the bill is a part of the country’s national AI strategy to “build trust in new technologies.” On June 4, Prime Minister Mark Carney announced the strategy to increase AI literacy and build basic AI infrastructure.
Philippe Dufresne, the country’s privacy watchdog, welcomed the bill. In his Monday statement, Dufresne said the bill would significantly enhance Canadians’ privacy when navigating the digital world and protect children’s privacy. Noting that the act transfers the privacy law enforcement power regarding commercial activities from his office to the new commission, Dufresne said he would assess the bill before providing his recommendations to Parliament.
Michael Geist, a privacy law professor at the University of Ottawa, criticized the bill for creating a “new digital super-regulator” tasked with both private-sector regulation and online harms policing. He observed that the rules of evidence are not binding on the commission and that it can hold secret hearings. He also raised the concern that the commission can decide even if there is only one appointee, appointed by the federal Cabinet.
The current federal Privacy Act mandates that the government consult party leaders in both the Senate and the House of Commons, and obtain approval from both chambers. If Parliament adopts the current bill, the privacy watchdog will only have jurisdiction over federal government agencies.
On June 10, the government tabled Bill C-34, the Safe Social Media Act. The bill seeks to protect children from intimate content, the addictive features of social media, and other materials that may harm their safety or that of third parties. The bill, however, faced backlashes for its “highly invasive” age-verification requirement and “uncertain” powers the new commission enjoys.
