2020: The Year of Modifications to the Canadian and Quebec Laws on Protection of Personal Information

Last December, the Prime Minister of Canada, the Right Honourable Justin Trudeau, sent a mandate letter to each of the ministers of his recently formed government. 

Among the priorities stated in the letters sent to the Minister of Justice, the Minister of Innovation, Science and Industry, and the Minister of Canadian Heritage, the Prime Minister expressed his expectations regarding the implementation of Canada’s Digital Charter, the enhancement of the powers of the Privacy Commissioner and the establishment of a new set of “online” rights. 

Enhancement of the powers of the Privacy Commissioner 

The Prime Minister’s statement of priorities was preceded by several proposals for changes made by the Commissioner himself. 

In his annual report published on December 10, the Federal Commissioner “is urging Parliamentarians to adopt rights-based privacy laws to better protect Canadians in the face of data-driven technologies creating serious risks for privacy.”¹

Among the proposals made by the Commissioner, he insists on the following:

• Carrying out proactive inspections;
• Making binding orders;
• Imposing penalties for non-compliance with the law. 

The Commissioner’s report also mentions the opportunity to adopt a law based on and granting rights to individuals rather than on obligations imposed on the organizations subject to the law. 

Establishment of new rights 

In his letter to the ministers, the Prime Minister expressly mentions the establishment of new rights related to personal data in the digital realm. The letter mentions the following:

• Personal data portability;
• The ability to remove, delete and erase personal data;
• The opportunity to know the intended uses;
• The ability to withdraw consent to the exchange or sale of personal data;
• The ability to review and question the quantity of data collected;
• Proactive data security requirements;
• Being informed about data breaches;
• Receiving appropriate compensation;
• Being safe from online discrimination. 

The rights to know the intended uses and the right to be informed are already established in the form of obligations imposed on organizations under federal law applicable to the private sector. 

The other rights set out in the Prime Minister’s letter have been enacted in the General Data Protection Regulation (“GDPR”) of the European Union, in effect since 2018. The government’s approach in this sense tends to demonstrate the willingness of Canada to align itself with the European framework, to maintain adequacy with this regimen that facilitates data transfers between member countries of the European Union and Canada. 

Canada’s Digital Charter 

Canada’s Digital Charter was published by the Canadian government following consultations in 2018. The objective of this charter is to build the trust of Canadians in the digital world. It sets out ten principles that will guide the different government programs and initiatives: 

1. Universal access: all Canadians will have equal opportunity to participate in the digital world and the necessary tools to do so; 
2. Safety and security of services offered online; 
3. Control and consent: Canadians will have control over what data they are sharing and for what purposes; 
4. Transparency, portability and interoperability: management of access to the personal data of Canadians will thus be facilitated; 
5. Open and modern digital government; 
6. A level playing field in the online market; 
7. Data and digital for the common good: the government will ensure that data from Canadians is used appropriately and ethically; 
8. Strong democracy; 
9. A digital environment free from hate and violent extremism; 
10. Strong enforcement and real accountability: clear, meaningful penalties will be set out for any violation of the laws and regulations that support these principles. 

The application of these principles is potentially very broad. The nature and extent of the government’s initiatives remain to be defined. 

Revision of Quebec laws 

Also of interest is the Quebec Justice Minister’s recent confirmation of the government’s intent to finally introduce a long overdue bill to modernize Quebec’s privacy laws. Both statutes were originally enacted in the eighties and nineties and haven’t been significantly amended since 2006. As with the federal government, we anticipate that the Quebec government will propose an approach aligned with the provisions of the GDPR. The Minister for Government Digital Transformation has recently made comments to that effect. 

Therefore, 2020 should be a pivotal year for the protection of personal information, at both the federal and provincial levels. Organizations doing business in Canada and Quebec will have to review their procedures to ensure compliance with these new provisions, which will have a significant impact on their obligations in this field.