Government of Canada Moves to Enhance Privacy of Individuals During Commercial Transactions

OTTAWA, ONTARIO--(Marketwire - Sept. 29, 2011) - The Honourable Christian Paradis, Minister of Industry, today announced an important step in further protecting the privacy of Canadians during commercial transactions with the reintroduction of amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA) in the House of Commons.

"Canadians have given our government a strong mandate to stay focused on what matters: creating jobs and economic growth. Ensuring trust and confidence through the protection of personal information is essential to the growth of the digital economy," said Minister Paradis. "Our government will continue to help protect consumers and businesses from the misuse of their personal information, thereby increasing confidence in the online marketplace."

PIPEDA sets privacy rules for the collection, use and disclosure of personal information in a way that balances the privacy rights of individuals with measures to maintain the flows of information that are necessary for the conduct of business. The Act has broad support in Canada and is recognized internationally as an effective and balanced approach to privacy protection.

The Bill includes provisions to better protect and empower consumers, clarify and streamline rules for business and enable effective investigations by law enforcement and security agencies. A key amendment would require organizations to report material breaches of personal information to the Privacy Commissioner of Canada. Affected individuals would also be notified when there is a risk of significant harm such as identity theft, fraud or risk to one's reputation. Notification would permit individuals to take steps to mitigate damages arising from the breach.

In a modern economy, a solid, efficient regime for the protection of personal information is of vital importance to both individuals and businesses.

"Canada already has a solid legislative framework in place to ensure the protection of personal information," said Minister Paradis. "These amendments are based on extensive consultations and will help us maintain a balanced and practical approach to privacy law."

The proposed amendments also allow for the release of personal information to help protect victims of financial abuse and include measures to better protect the privacy of minors online.

Backgrounder

Government of Canada Introduces Amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA)

The Government of Canada has reintroduced enhancements to private sector privacy legislation in a bill seeking to amend the Personal Information Protection and Electronic Documents Act (PIPEDA). In doing so, the government is implementing the Government Response to the first statutory review of PIPEDA.

In a modern economy, a solid and efficient regime for the protection of personal information is vitally important to both consumers and businesses.

To ensure that PIPEDA continues to keep pace with rapid marketplace and technological changes and their societal impacts, the proposed amendments in this Bill are designed to:

• protect and empower consumers;
• clarify and streamline rules for business;
• enable effective investigations by law enforcement and security agencies; and,
• make linguistic and other technical drafting corrections.

EMPOWERING CONSUMERS

The proposed amendments will make a significant contribution to the government's efforts to ensure a safe and secure Internet for Canadians. A key proposed amendment would require organizations to report material data breaches of personal information to the Privacy Commissioner of Canada and to notify affected individuals when the organization deems the breach to pose a real risk of significant harm, such as identity theft or fraud, or damage to reputation. This amendment will not only provide consumers with the information they need to mitigate harm resulting from a breach of their personal information, it will also encourage better information security practices within organizations. This proposed amendment will complement the government's identity theft law, An Act to amend the Criminal Code (identity theft and related misconduct).

Acknowledging the increasing Internet usage rates among youth, Canada is working with a number of international organizations to develop strategies to better protect children online. The Bill proposes an amendment to PIPEDA's consent regime that will provide further protection for children online by requiring organizations to consider the ability of their target audience to comprehend the consequences of sharing their personal information.

The Bill also proposes additional exceptions to allow for the release of personal information to help protect victims of financial abuse, to help locate missing persons and to identify injured, ill or deceased individuals.

STREAMLINING RULES FOR BUSINESS

In its October 2007 Response to the Report of the Standing Committee on Access to Information, Privacy and Ethics, the government committed to supporting business by providing greater clarity and certainty with respect to key provisions of PIPEDA. The Bill proposes exceptions to consent for the collection, use and disclosure of information needed for, among others, managing the employment relationship, information produced for work purposes ("work product") and information used for due diligence in business transactions. Organizations will also be able to share and use business contact information that is required to conduct day-to-day business.

In addition, a new provision allowing the disclosure of personal information without consent for private sector investigations and fraud prevention will replace a regulatory process that has been burdensome for small and medium-sized organizations.

SUPPORTING EFFECTIVE LAW ENFORCEMENT

Another key thrust of the Bill is supporting effective law enforcement. The government considers the safety and security of Canadian citizens to be of utmost importance. Proposed amendments will reaffirm the view that the information needs of law enforcement and security agencies can be met while respecting the privacy rights of Canadians. Proposed amendments would make it clear that organizations may collaborate with government institutions, such as law enforcement and security agencies that have requested personal information, in the absence of a warrant, subpoena, or order. To avoid jeopardizing investigations, new provisions would prohibit organizations from notifying an individual about the disclosure of his or her personal information to law enforcement and security agencies where the government institution to whom the information was disclosed objects.

COMPLETING A PARLIAMENTARY PROCESS

Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA) governs the collection, use and disclosure of personal information in the course of commercial activity. It has been in force since January 1, 2001, and is mandated to be reviewed by Parliament every five years.

This Bill acts on the government's October 2007 Response to the Report of the Standing Committee on Access to Information, Privacy and Ethics arising from the first Parliamentary review of the Act. The Government Response addressed each of the 25 recommendations contained in the Committee's report and committed to amending the Act in agreement with many of the Committee's recommendations.

In its report, the Committee recognized that the Act is working well and does not require major changes at this time. The Committee recommended the "fine-tuning" of some of the Act's provisions and encouraged increased harmonization with provincial privacy laws.

Industry Canada, which administers the Act, conducted formal consultations with stakeholders in order to further develop and define options for implementing the Government Response to the Committee report. The Government received 76 written submissions, and officials held more than 25 meetings involving a wide range of stakeholders including business, consumer and privacy advocates, the Privacy Commissioner of Canada, provincial governments and law enforcement authorities.

Where possible, the proposed amendments take into consideration approaches taken in provincial privacy laws.