The laws governing privacy in Canada are undergoing rapid change, particularly for organizations that collect and use the personal information of their clients and customers. These changes have been driven by both public and government concerns, but also reflect international developments such as the General Data Protection Regulation (GDPR). This recap summarizes the laws that were discussed during the webinar and provides resources for keeping your business in compliance with these new regulations.

Panelists:

 

PRIVACY LAWS IN CANADA

GLOSSARY

  • Bill C-27 (Previously Bill C-11): Digital Charter Implementation Act, was meant to repeal parts of PIPEDA and replace then with
    –  CPPA: Canada Consumer Privacy Protection Act, meant to modernize and provide stricter regulations and enforcement over personal Information
  • Quebec’s Bill 64 : An Act to modernize legislative provisions as regards the protection of personal information
  • CCPA: California Consumer Privacy Act- A state statute that enhances privacy rights and consumer protection for California residents
  • GDPR: General Data Protection Regulations- Data protection and privacy law in the European Union and European Economic Area.


Quebec’s Bill- 64

►On September 2021, Quebec adopted Bill 64: An Act to modernize legislation regarding the protection of personal information. This bill introduced significant changes to the provisions governing the use and protection of personal information under various laws. A three-year phased implementation of the bill will begin on September 22, 2022. To stay up to date with the three-year plan for Bill 64,

►IAB Canada has created an infographic that breaks down how Bill 64 will go into effect the next three years. Link.

►Bill 64 requires organizations to configure individuals’ privacy settings for products or services to offer the highest level of confidentiality and privacy. This includes appointing a privacy officer, mandatory breach reporting, and giving individuals the opportunity to expressly opt for such features in accordance with their preferences. Under the new legislation, organizations that do not comply with this requirement can be fined $10 million or 5% of global revenue, whichever is greater.

►To stay up to date on Bill 64, you can access it here


Canada’s Bill C-27

►On June 16, 2022, the Canadian government tabled in Parliament Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act, as well as amendments to other Acts.

►Bill C-27 would modernize Canada’s approach to private sector data protection and introduce new rules related to artificial intelligence (“AI”). The bill would establish three new statutes:

  • 1. The Consumer Privacy Protection Act (“CPPA”), which would repeal and replace the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and align it with the General Data Protection Regulation in Europe.
  • 2. The Personal Information and Data Protection Tribunal Act, which would allow organizations and individuals to seek review of decisions made by the Privacy Commissioner.
  • 3. The Artificial Intelligence and Data Act, which would regulate the development and deployment of AI in the Canadian marketplace.

►To stay up to date on Bill C-27, you can access it here

►The CMA has published a blog on the new bill, and a overview for CMA members, as well as a public overview. 

 

Cookies

►Google will not be supporting 3rd party cookies in late 2023 which means greater reliance on first party data

 

►Under PIPEDA, organizations are required to explain why they collect personal information.

 

►Once the intended use of the data has been completed, organizations must dispose of the data. Whenever they are used for statistical purposes, they should be rendered anonymous.

Notable Notes

►Having one federal law is the most effective approach for companies and consumers. Many provincial laws make compliance more complex and costly, without benefiting consumers.

►Legislation should be technology-neutral, so it can adapt to new technologies as they emerge. Otherwise, it becomes outdated.

►It is important to comply with privacy laws to maintain your company/industry’s reputation, and to maintain trust with consumers.

►Your consumer relationship should be as ethical as the way you would want your own data to be used.

 

Key Takeaways

►Sara’s Key Takeaways

  • 1. Keep current on developments. At stake is your reputation, and that of your company and industry sector, along with significant fines once Bill C-27 becomes law..
  • 2. Speak out on social media (especially Twitter) to support our advocacy efforts on behalf of the industry for balanced legislation.
  • 3. Make wise decisions by putting on your “consumer hat“. How do you want your data, and your kids’ data used? Your customers probably want the same.

 

►Jill’s Key Takeaways

  • 1. “Don’t wait to be told what to do” – Don’t wait for new legislation to impose your business practices; take action now!
  • 2. Explore and shore up your first party data, make sure you have proper consumer consent get prepared for a time when you can no longer rely on third party cookies.
  • 3. Use the proven technology and industry frameworks that already exist to improve upon your business practices.

 

►Joanne’s Key Takeaways

  • 1. Transparency creates trust with the end user and creates a positive relationship between you and your customers.
  • 2. “Putting the value exchange” –  When you are collecting data, it is important to make the value exchange clear. Let your end users know what they will get in return for giving you their information.

 

Courses

  • Businesses can stay in compliance with the new privacy laws by taking courses offered by both the IAB Canada and the CMA.
  • Privacy-First Essentials for Digital Advertising Professionals – IAB CANADA
  • CASL and Privacy 101 for Marketers – CMA

 

Resources

 

Resources from the CMA

Resources from the IAB