Home | Databases | WorldLII | Search | Feedback Privacy Laws and Business International Report

Canada widens privacy legislation [1998] PLBIRp 25; (1998) 45 Privacy Laws and Business International Report 16

Canada plans to widen its privacy legislation

CANADA AIMS TO INTRODUCE privacy legislation in the government regulated private sector by building on the CSA standard. Whether the provinces will follow the federal initiative remains to be seen.

Canada’s intention to introduce federal legislation for the government regulated private sector took a major step forward in January when the Federal Government released a dis- cussion paper The Protection of Personal Information - Building Canada’s Information Economy and Society. The proposed new law would apply to the banking, telecommunica- tions and transportation sectors which can be regulated by federal leg- islation. Other areas of the private sector would not be affected unless the provinces decide to legislate. At the moment, the rest of the private on the political agenda, Professor Bennett stressed. He predicted that a bill for the government regulated private sector would be introduced in Ottawa in the autumn. However, he also said that there is little hope for private sector legislation at the pro- vincial level in the immediate future.

BUSINESSES LIKE CSA STANDARD’S FLEXIBILITY

A total of 90 responses were received to the Government’s discussion paper from consumer and business groups, privacy commissioners and individu- als. The responses included of questions, including whether the Canadian Standards Association’s Model Code for the Protection of Personal Information (CSA Standard) could serve as a basis for private sector legislation (PL&B Sep ’96 pp 8-10). The CSA Standard, approved in 1996, is based on the OECD Privacy Guidelines and sets minimum requirements for the protection of personal data. As the standard has already been applied by some Canadian companies, there is support for having it as a starting point when drafting the law. The majority of businesses tha

sector does not need to obey any common rules as only Quebec has

replied would not change the stan- dard in any way. They emphasised

adopted comprehensive privacy legis- lation for the private sector.

QUEBEC SHOWS EXAMPLE

Quebec’s route has, however, led some businesses outside the province to follow suit. Associate Professor Colin Bennett of the University of Victoria, Canada, explained at the Privacy Laws & Business Annual Conference in July, Quebec’s impact on the whole privacy debate in Canada. As having to deal with dif- ferent privacy laws in different provinces has caused confusion, some businesses have chosen to harmonise their rules and provide the same level of protection in the rest of Canada as they do in Quebec. This has been the case especially in provincially regulated sectors such as insurance and retailing.

The complexity of different rules put the question of privacy protection two surveys organised by the Metropolitan Halifax Chamber of Commerce and the Privacy Forum Partners consisting of consumer groups, the Media Awareness Network and the Ottawa Public Library. All of the 270 responses received by Privacy Forum Partners supported private sector legislation. The level of support measured by the Chamber of Commerce was, however, ambiguous.

Responses were sought to a number

that the standard provides them with the necessary flexibility. However, Canadian privacy commissioners and consumer groups believed that private sector legislation should be more precise than the CSA standard, which does not provide for consumer redress.

NO TO REGISTRATION

One of the questions raised in the consultation was whether a central registration system is needed. There was some support for the idea, but as privacy commissioners did not support it, it is unlikely that such a system will be introduced.

In general, respondents were happy to give federal and provincial privacy commissioners enforcement powers. Most businesses did not favour the idea of privacy commis- sioners having broad investigative powers. The same applied for man- dated privacy impact assessments that

have been proposed as a measure to assess the privacy implications of new technologies. The business view was that such assessments may threaten technology innovation.

BINDING SECTORAL CODES HAVE LIMITED SUPPORT

Sectoral codes of practice are current- ly widely used in Canada, even in Quebec, where the law does not specifically mention them. Most trade associations have adopted privacy codes, and some of them already implement the provisions of the CSA standard. The consultation process revealed that there is only limited support for binding sectoral codes.

DRAFT PRIVACY LAW SOON Canada’s government seems keen to legislate soon. It wants to avoid com- panies having to get involved with contractual negotiations in order to demonstrate adequate privacy protec- tion for transborder flows as required by the EU Data Protection Directive. Another reason for action is the explosive growth of electronic com- merce and the privacy questions related to it. Regulating the whole private sec- tor is only possible if the provinces follow the federal initiative. Drafting work for a uniform act was started in

1995 by the Uniform Law Conference (ULCC) which promotes uniform legislation across the provinces. The consultation showed strong support for the Conference to undertake work on harmonising federal and provincial privacy legislation. A draft private sector Data Protection Act has been circulated for comment. It is likely to take another year, however, before it is finally approved and sub- mitted to the provinces.

The responses to the Federal Government’s consultation are available at http://strategis.ic.gc.ca. The CSA Standard is also

available on the Internet,

http://www.csa.ca/83002-g.htm