{"id":34613,"date":"2022-07-29T14:29:48","date_gmt":"2022-07-29T18:29:48","guid":{"rendered":"https:\/\/www.cccc.org\/news_blogs\/?p=34613"},"modified":"2022-08-08T11:47:59","modified_gmt":"2022-08-08T15:47:59","slug":"a-new-privacy-regime-proposed-in-bill-c-27","status":"publish","type":"post","link":"https:\/\/www.cccc.org\/news_blogs\/legal\/2022\/07\/29\/a-new-privacy-regime-proposed-in-bill-c-27\/","title":{"rendered":"A New Privacy Regime Proposed in Bill C-27"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">On June 16th, 2022, a new privacy regime was proposed in Bill C-27, the <a href=\"https:\/\/www.parl.ca\/DocumentViewer\/en\/44-1\/bill\/C-27\/first-reading\" target=\"_blank\" rel=\"noreferrer noopener\"><em>Digital Charter Implementation Act<\/em><\/a>. This Act, which is still at first reading, would protect individuals\u2019 personal information and regulate organizations\u2019 privacy practices. It is intended to modernize Canada\u2019s private sector privacy laws.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">New Acts Created by Bill C-27<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This ambitious bill aims to implement numerous privacy changes. If enacted, Bill C-27 would:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Create the&nbsp;<em>Consumer Privacy Protection Act<\/em><em>&nbsp;<\/em>(CPPA)<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The CPPA would replace Part 1 of the<a href=\"https:\/\/canlii.ca\/t\/541b8\" target=\"_blank\" rel=\"noreferrer noopener\">&nbsp;<em>Personal Information Protection and Electronic Documents Act<\/em><\/a>&nbsp;(PIPEDA), Canada\u2019s current private sector privacy law. It proposes modern privacy protection similar to the EU\u2019s <em><a href=\"https:\/\/gdpr-info.eu\/\" target=\"_blank\" rel=\"noreferrer noopener\">General Data Protection Regulation<\/a> <\/em>(GDPR) and provides more clarity for organizations than our current privacy regime.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Create the&nbsp;<em>Personal Information and Data Protection Tribunal Act<\/em>&nbsp;(PIDPTA)<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The PIDPTA would establish a tribunal that would hear the <a href=\"https:\/\/www.priv.gc.ca\/en\/\" target=\"_blank\" rel=\"noreferrer noopener\">Office of the Privacy Commissioner of Canada<\/a>\u2019s (OPC) recommendations on administrative monetary penalties and appeals from certain inquiry findings and specific orders of the OPC.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Enact the Artificial Intelligence and Data Act (AIDA)<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The AIDA would regulate \u201cinternational and interprovincial trade and commerce in AI systems\u201d and prohibit certain conduct that could seriously harm individuals and their interests.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Bill C-27\u2019s Impact on Canadian Charities<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If Bill C-27 is passed, it will set out legal requirements for those subject to its jurisdiction, and it will set expectations for best practices. Canadian charities should consider how Bill C-27 would impact the way they handle personal information. Given increased liability and penalties under the proposed CPPA, charities should vigorously review their existing data policies and management to protect themselves from legal liabilities and to protect the privacy of their stakeholders.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Definition of Commercial Activities<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Bill C-27 uses PIPEDA\u2019s definition of \u201c<a href=\"https:\/\/www.canlii.org\/en\/ca\/laws\/stat\/sc-2000-c-5\/latest\/sc-2000-c-5.html#sec2subsec1\" target=\"_blank\" rel=\"noreferrer noopener\">commercial activities<\/a>\u201d which includes selling, bartering, leasing donor, membership, or other fundraising lists. Therefore, <a href=\"https:\/\/www.priv.gc.ca\/en\/privacy-topics\/privacy-laws-in-canada\/the-personal-information-protection-and-electronic-documents-act-pipeda\/r_o_p\/02_05_d_19\/\" target=\"_blank\" rel=\"noreferrer noopener\">federal privacy laws will still apply <\/a>to Canadian charities engaged in such activities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bill C-27&#8217;s failed predecessor, <a href=\"https:\/\/parl.ca\/DocumentViewer\/en\/43-2\/bill\/C-11\/first-reading\" target=\"_blank\" rel=\"noreferrer noopener\">Bill C-11<\/a>, proposed a restricted definition of &#8220;commercial activities,&#8221; that could have led many charities and non-profits to believe they no longer had to comply with federal private sector privacy laws. By returning to PIPEDA\u2019s definition of \u201ccommercial activities\u201d, Bill C-27 will still capture elements of what charities may do, such as selling, bartering, leasing donor, membership, or other fundraising lists.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Other Important Proposals<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is only a partial list, and since the bill has only just begun its journey through Parliament it could see significant changes along the way. This partial list highlights notable changes that may interest Canadian charities.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Valid consent<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Organizations must use plain language when seeking permission to collect, use or disclose an individual&#8217;s personal information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Organizations must not use misleading practices to obtain consent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Organizations can sometimes collect and use data without consent:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>If its reasonable for security purposes<\/li><li>If its reasonable for safety reasons<\/li><li>In other prescribed situations<\/li><li>When there are \u201clegitimate interests.\u2019<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">People can withdraw consent subject to similar limitations that currently exist in PIPEDA. However, unlike PIPEDA, under the CPPA, an individual can also require that an organization dispose of their information. Disposal includes deletion and rendering the data anonymous.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Minors<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Minors\u2019 data means any &#8220;sensitive personal information.&#8221; Accordingly, privacy practices may require changes to ensure this information is adequately protected.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Private Actions<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Individuals can bring a direct action for damages if they are affected by an organization\u2019s infringement of the CPPA. The Act will also allow aggrieved individuals to file such actions in the superior court of a province.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Strengthened Enforcement Regime<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Bill C-27 implements significant penalties for non-compliance with the CPPA.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Provincial Requirements<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Organizations with operations in Quebec, British Columbia and Alberta will have to comply with both (the substantially similar) provincial privacy laws and with the CPPA when moving data from one province to another.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Automated Decisions<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Individuals will have the right to require an organization to explain how an automated decision-making system could significantly impact them.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">For more on privacy&#8230;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Members can check out CCCC <a href=\"https:\/\/www.cccc.org\/kbm\/Content\/communications\/privacy\/privacy-lp.htm\">privacy resources<\/a> in our Knowledge Base.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>On June 16th, 2022, a new privacy regime was proposed in Bill C-27, the Digital Charter Implementation Act. This Act, which is still at first reading, would protect individuals\u2019 personal information and regulate organizations\u2019 privacy practices. It is intended to modernize Canada\u2019s private sector privacy laws. New Acts Created by&#8230; <a href=\"https:\/\/www.cccc.org\/news_blogs\/legal\/2022\/07\/29\/a-new-privacy-regime-proposed-in-bill-c-27\/\" class=\"linkbutton\">More<\/a><\/p>\n","protected":false},"author":10,"featured_media":34641,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ts_fic_featured_image_caption":"Photo by <a href=\"https:\/\/unsplash.com\/@franckinjapan?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText\">Franck<\/a> on <a href=\"https:\/\/unsplash.com\/?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText\">Unsplash<\/a>   ","footnotes":""},"categories":[137],"tags":[497,284,471],"series":[],"class_list":["post-34613","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-federal","tag-legislation","tag-privacy"],"_links":{"self":[{"href":"https:\/\/www.cccc.org\/news_blogs\/wp-json\/wp\/v2\/posts\/34613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cccc.org\/news_blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cccc.org\/news_blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cccc.org\/news_blogs\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cccc.org\/news_blogs\/wp-json\/wp\/v2\/comments?post=34613"}],"version-history":[{"count":0,"href":"https:\/\/www.cccc.org\/news_blogs\/wp-json\/wp\/v2\/posts\/34613\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cccc.org\/news_blogs\/wp-json\/wp\/v2\/media\/34641"}],"wp:attachment":[{"href":"https:\/\/www.cccc.org\/news_blogs\/wp-json\/wp\/v2\/media?parent=34613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cccc.org\/news_blogs\/wp-json\/wp\/v2\/categories?post=34613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cccc.org\/news_blogs\/wp-json\/wp\/v2\/tags?post=34613"},{"taxonomy":"series","embeddable":true,"href":"https:\/\/www.cccc.org\/news_blogs\/wp-json\/wp\/v2\/series?post=34613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}