Skip to content

Privacy practice tune-up – getting ready for the Consumer Privacy Protection Act

Rob Aske

As we wrote about earlier, Canada’s federal government has proposed a replacement to our national privacy law for commercial transactions known as the Personal Information Protection and Electronic Documents Act (“PIPEDA”).

The new bill is the Digital Charter Implementation Act, and this bill in turn would create a new Consumer Privacy Protection Act (“CPPA”) which would replace the privacy portion of PIPEDA.

The CPPA will likely not come into force for a year or more, while consultations and the drafting of regulations proceed.

However, the proposed CPPA does restate and expand on the existing privacy law requirements of PIPEDA, and if your business needs a privacy tune-up then CPPA can provide a useful guide, with better detail than PIPEDA offers now.

Privacy management program

For example, CPPA requires all organizations (including businesses) to implement a “privacy management program” including policies, practices and procedures for protection of personal information, complaints handling, training of personnel and for explaining these practices to the public. This program must take into account the “volume and sensitivity of the personal information” under the organization’s control.

CPPA also obliges an organization to provide the federal Privacy Commissioner with access to all policies, practices and procedures of its privacy management program, merely upon request, which of course could give the Commissioner a good look into any program gaps. If the Commissioner has reasonable grounds to believe that a breach of privacy obligations has occurred, then the Commissioner may choose to “audit” these practices.

Further detail on consent

The required consent for use of personal information is also described in CPPA in greater detail, and states that consent is only valid if at or before the time that the organization seeks the individual’s consent, it provides the following information in “plain language”:

(a) the purposes for the collection, use or disclosure;

(b) the way in which the personal information is to be collected, used or disclosed;

(c) any reasonably foreseeable consequences of the collection, use or disclosure of the personal information;

(d) the specific type of personal information that is to be collected, used or disclosed; and

(e) the names of any third parties or types of third parties to which the organization may disclose the personal information.

Consent must be obtained at or before collection, and must be express unless it is appropriate to rely on implied consent, taking into account the reasonable expectations of the individual and the sensitivity of the personal information.

Plain language privacy policies

CPPA also gives clearer guidance on privacy policies to be made available to customers and others providing personal information, which must again be in “plain language” and include at least the following:

(a) a description of the type of personal information under the organization’s control;

(b) a general account of how the organization makes use of personal information, including how the organization applies any permitted exceptions;

(c) a general account of the organization’s use of any automated decision system (e.g. AI systems) to make predictions, recommendations or decisions about individuals that could have significant impacts on them;

(d) whether or not the organization carries out any international or interprovincial transfer or disclosure of personal information that may have reasonably foreseeable privacy implications;

(e) how an individual may make a request for disposal or access; and

(f) the business contact information for your privacy officer.

While the policy requirements above about automated decision systems and international and interprovincial transfers are part of many policies now, they are new as express requirements of the law.

Therefore, all businesses that may be considering a tune-up of their privacy practices and policies should review the standards as outlined in the proposed CPPA, including those above.


This article is provided for general information only. If you have any questions about the above, please contact a member of our Privacy group.

Click here to subscribe to Stewart McKelvey Thought Leadership articles and updates.

SHARE

Archive

Search Archive


 
 

Recognizing subtle discrimination in the workplace: insights from recent legal cases

March 4, 2024

By Sheila Mecking and Michiko Gartshore Subtle discrimination can have a much stronger and longer effect on employees when not properly addressed. It can also result in costly consequences for an employer who does not…

Read More

Immediate changes to travel eligibility for citizens of Mexico

February 29, 2024

By Brittany Trafford and Brendan Sheridan Today Immigration, Refugees and Citizenship Canada (“IRCC”) has announced significant changes to the travel requirements for Mexican citizens. As of February 29, 2024 at 11:30p.m. Eastern Time, all electronic…

Read More

Updated guidance on business reporting obligations under Canada’s supply chain transparency legislation

February 23, 2024

By Christine Pound, ICD.D., Twila Reid, ICD.D., Sarah Dever Letson, CIPP/C, Hilary Newman and Daniel Roth Introduction As we reported on November 30, 2023, the Fighting Against Forced Labour and Child Labour in Supply Chains…

Read More

Trustees beware! New trust reporting and disclosure requirements under the Income Tax Act are here – are you ready for them?

February 21, 2024

By Richard Niedermayer, K.C., TEP  & Rackelle Awad New trust disclosure rules originally announced on February 27, 2018, are now in force, and trusts with taxation years ending on or after December 31, 2023 are…

Read More

Proposed Criminal Interest Rate Regulations: exemptions to the lower criminal interest rate

February 14, 2024

By David Wedlake and Andrew Paul In late December 2023, the Federal Government issued draft Criminal Interest Rate Regulations under the Criminal Code. These proposed regulations follow the Budget Implementation Act, 2023, No. 1 which…

Read More

Outlook for 2024 Proxy Season

February 9, 2024

By Andrew Burke, Colleen Keyes, Gavin Stuttard, David Slipp and Logan Walters With proxy season on the horizon, many public companies are once again preparing their annual disclosure documents and shareholder materials for their annual…

Read More

Significant changes announced for new study permit applications

February 6, 2024

By Brendan Sheridan and Tiegan Scott The Government of Canada recently announced further changes to the international student program that not only limits the number of new study permit applicants per year, but also increases…

Read More

Plans of arrangement come to Newfoundland and Labrador

January 30, 2024

By Tauna Staniland, K.C., ICD.D, Joe Thorne, and Nadine Otten What can you do when your corporation wants to complete a complex transaction requiring significant corporate restructuring that cannot be easily completed under the corporation’s…

Read More

Energy Watch

January 29, 2024

Stewart McKelvey is pleased to present Energy Watch – a review of key legislative and policy advancements in the renewable energy sector in 2023 in each of Newfoundland and Labrador, Nova Scotia and New Brunswick…

Read More

Beyond the border: A year end immigration wrap-up

December 21, 2023

We are pleased to present Beyond the border: A year end immigration wrap-up. Compiled by Lawyers from our Immigration team, this 2023 update covers topics including the Government of Canada’s ambitious immigration plans for the future;…

Read More

Search Archive


Scroll To Top