The Canadian Research Insights Council (CRIC) is seeking privacy experts from CRIC member companies to assist in developing industry positions in response to proposed new provincial and federal privacy legislation.
Over the last year, there has been a significant push by governments in Canada to modernize privacy frameworks.
Most notably, on November 17, the Federal government introduced Bill C-11, The Digital Charter Implementation Act. The proposed legislation seeks to modernize Canada’s privacy laws and represents the most significant change to the private sector privacy framework in over 20 years since the adoption of PIPEDA. If adopted, Bill C-11 would in fact repeal Part 1 of PIPEDA (that deals with privacy) and lead to the creation of a new Consumer Privacy Protection Act (CPPA).
At the core of the research, analytics, and insights industry is the good relationship that exists between researchers and the public. CRIC members devote considerable time and effort to protecting that relationship through self-regulation and world-leading standards, much of which centres around protecting a person’s right to privacy.
As such, CRIC’s starting point is to be supportive of efforts to modernize privacy frameworks in Canada as this can only result in a collective raising of the bar for all industries in how personal information is collected, used, and disclosed. CRIC is establishing a new privacy advisory committee to review Bill C-11 and other legislation, help develop a strong industry response, and identify any provisions in the legislation that would benefit from improvements.
Key proposals in Bill C-11 include:
Enhanced Powers for the Privacy Commissioner:
- If adopted, the CPPA would give stronger enforcement powers to the privacy commissioner including the ability to recommend penalties to a new Tribunal that could impose fines of up to $25 million, the highest among G-7 countries.
Changes to Consent Provisions:
- When seeking consent, organizations would need to provide “reasonably foreseeable consequences of the collection, use or disclosure” and the “names of any third parties or types of third parties to which the organization may disclose the personal information.”
- The CPPA would also add grounds for processing personal information without consent for valid reasons, including as necessary to provide a product or service requested by an individual, for public interest purposes, and where obtaining consent would be impracticable due to the lack of a direct relationship.
Enhanced Rights of Individuals:
- Bill C-11 introduces new rights for individuals including the right to data portability (the transfer of personal information to another organization) and the right of erasure (the limited right to have one’s personal information deleted by an organization).
Transparency in the Use of Automated Decision Making:
- Organizations would be required to provide a description to individuals on how their personal information was used to predict, recommend or make decisions.
De-identification of personal information:
- The CPPA would provide the right to use personal information without knowledge or consent to de-identify that information, for example for internal research and development purposes.
Certification of industry codes:
- Bill C-11 proposes that the Office of the Privacy Commissioner would have the power to certify industry codes that offer substantially the same or greater protections than offered under CCPA.
In addition to the proposed new federal privacy legislation, there are also privacy initiatives being introduced provincially:
- Quebec has tabled Bill 64 to update its privacy legislation for the private sector.
- Ontario has launched a consultation process regarding new privacy legislation that would apply to the private sector.
- British Columbia’s Office of the Information and Privacy Commissioner (OIPC) recently recommended that B.C.’s Personal Information Protection Act (PIPA) be reformed to align more closely with provincial, federal and international standards.
Given the proposed changes, privacy will be a major focus of CRIC’s advocacy efforts. CRIC will be consulting members on the implication of key changes and would also encourage those CRIC member companies who have expertise in privacy laws to participate in CRIC’s privacy advisory committee. To learn more or express interest in joining the CRIC privacy advisory committee, please contact CRIC’s Chief Administrative Officer, John Tabone at [email protected].
About CRIC
The Canadian Research Insights Council (CRIC) is Canada’s voice of the research, analytics and insights profession both domestically and globally. CRIC represents the highest standards, ethics and best practices; provides effective promotion and advocacy of the industry; serves as a source of information and thought leadership; and is a forum for collective industry action.
For more information, visit www.canadianresearchinsightscouncil.ca or contact John Tabone at [email protected].
Contact Us
For more information, contact John Tabone, Chief Administrative Officer:
