Skip to content

Privacy practice tune-up – getting ready for the Consumer Privacy Protection Act

Rob Aske

As we wrote about earlier, Canada’s federal government has proposed a replacement to our national privacy law for commercial transactions known as the Personal Information Protection and Electronic Documents Act (“PIPEDA”).

The new bill is the Digital Charter Implementation Act, and this bill in turn would create a new Consumer Privacy Protection Act (“CPPA”) which would replace the privacy portion of PIPEDA.

The CPPA will likely not come into force for a year or more, while consultations and the drafting of regulations proceed.

However, the proposed CPPA does restate and expand on the existing privacy law requirements of PIPEDA, and if your business needs a privacy tune-up then CPPA can provide a useful guide, with better detail than PIPEDA offers now.

Privacy management program

For example, CPPA requires all organizations (including businesses) to implement a “privacy management program” including policies, practices and procedures for protection of personal information, complaints handling, training of personnel and for explaining these practices to the public. This program must take into account the “volume and sensitivity of the personal information” under the organization’s control.

CPPA also obliges an organization to provide the federal Privacy Commissioner with access to all policies, practices and procedures of its privacy management program, merely upon request, which of course could give the Commissioner a good look into any program gaps. If the Commissioner has reasonable grounds to believe that a breach of privacy obligations has occurred, then the Commissioner may choose to “audit” these practices.

Further detail on consent

The required consent for use of personal information is also described in CPPA in greater detail, and states that consent is only valid if at or before the time that the organization seeks the individual’s consent, it provides the following information in “plain language”:

(a) the purposes for the collection, use or disclosure;

(b) the way in which the personal information is to be collected, used or disclosed;

(c) any reasonably foreseeable consequences of the collection, use or disclosure of the personal information;

(d) the specific type of personal information that is to be collected, used or disclosed; and

(e) the names of any third parties or types of third parties to which the organization may disclose the personal information.

Consent must be obtained at or before collection, and must be express unless it is appropriate to rely on implied consent, taking into account the reasonable expectations of the individual and the sensitivity of the personal information.

Plain language privacy policies

CPPA also gives clearer guidance on privacy policies to be made available to customers and others providing personal information, which must again be in “plain language” and include at least the following:

(a) a description of the type of personal information under the organization’s control;

(b) a general account of how the organization makes use of personal information, including how the organization applies any permitted exceptions;

(c) a general account of the organization’s use of any automated decision system (e.g. AI systems) to make predictions, recommendations or decisions about individuals that could have significant impacts on them;

(d) whether or not the organization carries out any international or interprovincial transfer or disclosure of personal information that may have reasonably foreseeable privacy implications;

(e) how an individual may make a request for disposal or access; and

(f) the business contact information for your privacy officer.

While the policy requirements above about automated decision systems and international and interprovincial transfers are part of many policies now, they are new as express requirements of the law.

Therefore, all businesses that may be considering a tune-up of their privacy practices and policies should review the standards as outlined in the proposed CPPA, including those above.


This article is provided for general information only. If you have any questions about the above, please contact a member of our Privacy group.

Click here to subscribe to Stewart McKelvey Thought Leadership articles and updates.

SHARE

Archive

Search Archive


 
 

Let’s talk about batteries: Nova Scotia Power’s latest development in renewable energy

July 18, 2024

In conjunction with our upcoming sponsorship of the Halifax Chamber of Commerce luncheon, featuring the Minister of Energy and Natural Resources the Hon. Jonathan Wilkinson, we are pleased to present a Thought Leadership article highlighting…

Read More

“Sale” away: The SCC’s more flexible approach to exclusion clauses in contracts for the sale of goods

July 9, 2024

By Jennifer Taylor & Marina Luro A recent Supreme Court of Canada decision has clarified how to interpret exclusion clauses in sale of goods contracts. The Court in Earthco Soil Mixtures Inc. v Pine Valley…

Read More

Recent case re-confirms temporary ailment is not a disability

June 24, 2024

By Mark Tector and Tiegan A. Scott Decision On April 3, 2024, the Alberta Court of King’s Bench (“ABKB”) upheld a decision of the Chief of the Commissions and Tribunals (the “CCT Decision”), which held…

Read More

Compensation for expropriation: Fair, but not more than fair

June 17, 2024

By Erin Best, Stephen Penney, Robert Bradley, Megan Kieley1 and Elizabeth Fleet1 Expropriation is a live issue in Canadian courts. The Supreme Court of Canada’s decision to broaden the test for constructive expropriation in Annapolis…

Read More

Changes affecting federally regulated employers

June 10, 2024

By Killian McParland and Sophie Poulos There have been many changes in recent months affecting employers governed by federal labour and employment laws. In September 2024, Stewart McKelvey will be hosting a webinar to review…

Read More

Impending changes to Nova Scotia’s Workers’ Compensation Act – Gradual onset stress

June 4, 2024

By Mark Tector and Annie Gray What’s changing? Currently, workers’ compensation coverage in Nova Scotia applies to only a narrow subset of psychological injuries. Specifically, in Nova Scotia – as in all Atlantic Provinces –…

Read More

Appeal Courts uphold substantial costs awards for regulators

May 22, 2024

By Sean Kelly & Michiko Gartshore Professional regulators can incur substantial costs through discipline processes. These costs are often associated with investigations, hearings as well as committee member expenses and are an unfortunate by-product of…

Read More

Less than two weeks to go … Canada Supply Chain Transparency Reports are due May 31st

May 21, 2024

By Christine Pound, ICD.D., Twila Reid, ICD.D., Sarah Dever Letson, CIPP/C, Sheila Mecking, Hilary Newman, and Daniel Roth Introduction The first reports under the Fighting Against Forced Labour and Child Labour in Supply Chains Act (the…

Read More

Court upheld municipality’s refusal to disclose investigation report

May 1, 2024

By Sheila Mecking and Sarah Dever Letson A recent decision out of the Court of King’s Bench of New Brunswick,[1] upheld the Municipality of Tantramar’s decision to withhold a Workplace Assessment Report under section 20(1)…

Read More

Occupational Health and Safety sentencing decision – Nova Scotia

April 29, 2024

By Sean Kelly & Tiegan Scott Earlier this month, the Provincial Court of Nova Scotia issued its sentencing decision in R v The Brick Warehouse LP, 2024 NSPC 26, imposing a monetary penalty of $143,750 (i.e.,…

Read More

Search Archive


Scroll To Top