The Canadian Research Insights Council (CRIC) is seeking privacy experts from CRIC member companies to assist in developing industry positions in response to proposed new provincial and federal privacy legislation.
Over the last year, there has been a significant push by governments in Canada to modernize privacy frameworks.
Most notably, on November 17, the Federal government introduced Bill C-11, The Digital Charter Implementation Act. The proposed legislation seeks to modernize Canada’s privacy laws and represents the most significant change to the private sector privacy framework in over 20 years since the adoption of PIPEDA. If adopted, Bill C-11 would in fact repeal Part 1 of PIPEDA (that deals with privacy) and lead to the creation of a new Consumer Privacy Protection Act (CPPA).
At the core of the research, analytics, and insights industry is the good relationship that exists between researchers and the public. CRIC members devote considerable time and effort to protecting that relationship through self-regulation and world-leading standards, much of which centres around protecting a person’s right to privacy.
As such, CRIC’s starting point is to be supportive of efforts to modernize privacy frameworks in Canada as this can only result in a collective raising of the bar for all industries in how personal information is collected, used, and disclosed. CRIC is establishing a new privacy advisory committee to review Bill C-11 and other legislation, help develop a strong industry response, and identify any provisions in the legislation that would benefit from improvements.
Key proposals in Bill C-11 include:
Enhanced Powers for the Privacy Commissioner:
- If adopted, the CPPA would give stronger enforcement powers to the privacy commissioner including the ability to recommend penalties to a new Tribunal that could impose fines of up to $25 million, the highest among G-7 countries.
Changes to Consent Provisions:
- When seeking consent, organizations would need to provide “reasonably foreseeable consequences of the collection, use or disclosure” and the “names of any third parties or types of third parties to which the organization may disclose the personal information.”
- The CPPA would also add grounds for processing personal information without consent for valid reasons, including as necessary to provide a product or service requested by an individual, for public interest purposes, and where obtaining consent would be impracticable due to the lack of a direct relationship.
Enhanced Rights of Individuals:
- Bill C-11 introduces new rights for individuals including the right to data portability (the transfer of personal information to another organization) and the right of erasure (the limited right to have one’s personal information deleted by an organization).