The day’s top stories from around the world
Where the real conversations in privacy happen
Original reporting and feature articles on the latest privacy developments
Alerts and legal analysis of legislative trends
Exploring the technology of privacy
A roundup of the top Canadian privacy news
A roundup of the top European data protection news
A roundup of the top privacy news from the Asia-Pacific region
A roundup of the top privacy news from Latin America
A roundup of US privacy news
The nomination period is now open. Submit your application today. Winners will be celebrated at wide-reaching virtual events hosted by IAPP KnowledgeNet Chapters!
Talk privacy and network with local members at IAPP KnowledgeNet Chapter meetings, taking place worldwide.
Advisory Board, KnowledgeNet Chapter Chair and Young Privacy Professional applications are now open. (Leadership positions are for members only. Join today.)
Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.
Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.
Locate and network with fellow privacy professionals using this peer-to-peer directory.
Review a filterable list of conferences, KnowledgeNets, LinkedIn Live broadcasts, networking events, web conferences and more.
Understand Europe’s framework of laws, regulations and policies, most significantly the GDPR.
Steer a course through the interconnected web of federal and state laws governing U.S. data privacy.
Learn the intricacies of Canada’s distinctive federal/provincial/territorial data privacy governance systems.
Develop the skills to design, build and operate a comprehensive data protection program.
Add to your tech knowledge with deep training in privacy-enhancing technologies and how to deploy them.
Introductory training that builds organizations of professionals with working privacy knowledge.
Learn the legal, operational and compliance requirements of the EU regulation and its global influence.
Meet the stringent requirements to earn this American Bar Association-certified designation.
The global standard for the go-to person for privacy laws, regulations and frameworks
The first and only privacy certification for professionals who manage day-to-day operations
As technology professionals take on greater privacy responsibilities, our updated certification is keeping pace with 50% new content covering the latest developments.
Recognizing the advanced knowledge and issue-spotting skills a privacy pro must attain in today’s complex world of data privacy.
The first title to verify you meet stringent requirements for knowledge, skill, proficiency and ethics in privacy law, and one of the ABA’s newest accredited specialties.
The IAPP’S CIPP/E and CIPM are the ANSI/ISO-accredited, industry-recognized combination for GDPR readiness. Learn more today.
Mostre seus conhecimentos na gestão do programa de privacidade e na legislação brasileira sobre privacidade.
Certification des compétences du DPO fondée sur la législation et règlementation française et européenne, agréée par la CNIL.
Use the Vendor Demo Center, Privacy Vendor List and Privacy Tech Vendor Report to easily identify privacy products and services to support your work.
On this topic page, you can find the IAPP’s collection of coverage, analysis and resources related to international data transfers.
The IAPP’s US State Privacy Legislation Tracker consists of proposed and enacted comprehensive state privacy bills from across the U.S.
This tracker organizes the privacy-related bills proposed in Congress to keep our members informed of developments within the federal privacy landscape.
Access all reports and surveys published by the IAPP.
Access all white papers published by the IAPP.
IAPP members can get up-to-date information here on the California Consumer Privacy Act and the California Privacy Rights Act.
The IAPP’s EU General Data Protection Regulation page collects the guidance, analysis, tools and resources you need to make sure you’re meeting your obligations.
This chart maps several comprehensive data protection laws to assist our members in understanding how data protection is being approached around the world.
This interactive tool provides IAPP members access to critical GDPR resources — all in one location.
Join DACH-region data protection professionals for practical discussions of issues and solutions. Presented in German and English.
P.S.R. 2022 is the place for speakers, workshops and networking focused on the intersection of privacy and technology.
Europe’s top experts predict the evolving landscape and give insights into best practices for your privacy programme.
Gain exclusive insights about the ever-changing data privacy landscape in ANZ and beyond.
Explore the full range of U.K. data protection issues, from global policy to daily operational details.
Concentrated learning, sharing, and networking with all sessions delivered in parallel tracks — one in French, the other in English.
The world’s top privacy conference. Whether you work in the public or private sector, anywhere in the world, the Summit is your can’t-miss event.
View our open calls and submission instructions.
Increase visibility for your organization — check out sponsorship opportunities today.
Review upcoming IAPP conferences to see which need to be included in your schedule for the year ahead.
Start taking advantage of the many IAPP member benefits today
See our list of high-profile corporate members—and find out why you should become one, too
Don’t miss out for a minute—continue accessing your benefits
Review current member benefits available to Australia and New Zealand members
Last week, while privacy professionals in Canada were still contemplating Bill C-26 on cybersecurity, the much-anticipated Digital Charter Implementation Act, 2022 — Bill C-27 — was introduced by the federal government. It is a reintroduction and, some may agree, an improvement of Bill C-11, first introduced in 2020 and failed on the order paper as a result of the federal election in 2021.
The new statutory framework in Bill C-27 governs private sector personal information protection practices and, if passed, would enact the following three new statutes:
In this article, we aim to highlight some key elements of the new bill. We don’t try to cover Bill C-27 in its entirety and we do not attempt to compare it with its predecessor, Bill C-11. Many folks sharing red-lined documents that compare the bills on social media have already done a good job of that!
The CPPA grants the Privacy Commissioner of Canada broad order-making powers and prescribes significant administrative monetary penalties up to $10 million CAD or 3% of global revenue. Fines are augmented in the case of serious contravention resulting in offenses that may attract a maximum penalty of $25 million CAD or 5% of global revenue. Additionally, a new private right of action is conferred to any individual who suffers losses or injuries as a result of the contravention of the CPPA.
Consent continues to be an important gatekeeper, but the CPPA lifts some burden from the individual to understand and give consent by focusing more on the organization’s accountability and transparency. For example, there is a new requirement for an organization to implement a privacy management program. In developing such a program, the organization must consider the volume and sensitivity of the personal information under its control. The commissioner may access the policies, practices and procedures developed under the privacy management program and, after reviewing them, provide guidance on or recommend corrective measures for the organization about its privacy management program.
To allow for flexibility for businesses, the CPPA permits the following list of exceptions to the requirement of consent under the head of Business Operations, including:
Of particular interest is the exception of “legitimate interest” in conducting business activities. An organization may collect or use an individual’s personal information without knowledge or consent if the legitimate interest of an activity outweighs any potential adverse effect on the individual resulting from such collection or use. There are two conditions to this: a reasonable person would expect such collection or use, and the personal information is not collected or used for the purpose of influencing the individual’s behavior or decisions. The crucial element is the organization’s assessment of associated risks and benefits and how it may mitigate those risks. The organization will have to demonstrate to the commissioner they are diligent in their assessment efforts.
There are exceptions to the exceptions — no, that’s not a typo! Some of the above exceptions do not apply if an individual’s electronic address is collected using a computer program designed or marketed primarily for generating, searching for and collecting electronic addresses. The exceptions also do not apply when personal information is collected by accessing a computer system or causing a computer system to be accessed. In these cases, express consent is required.
The CPPA clarifies, to a degree, the concepts of “deidentified” and “anonymized” information. Personal information that has been anonymized is carved out of the legislation. “Anonymize” is defined as “to irreversibly and permanently modify personal information” such that it is impossible to reidentify them according to “generally accepted best practices.” On the other hand, “deidentified” personal information is still considered personal information. “Deidentify” is defined as “to modify personal information so that an individual cannot be directly identified from it, though a risk of the individual being identified remains.” An organization may use “deidentified” personal information without consent for internal research, analysis and development purposes. Additionally, an organization may disclose “deidentified” personal information for a socially beneficial purpose, without consent, to a limited list of bodies: a government institution, a health care institution or any organization that is mandated to carry out a socially beneficial purpose. The CPPA requires organizations ensure deidentification measures are proportionate to the purpose for which the information is deidentified and the sensitivity of the personal information.
The CPPA has explicitly addressed the protection of the personal information of minors. According to the CPPA, all personal information of minors is sensitive information. However, the definition of “minor” is not found in federal legislation. The definition will be deferred to the provinces, which is under the age of 18 or 19.
Currently, an individual may request access to or correct their personal information under an organization’s control. The CPPA now grants the individual the right to request the disposal of their personal information in writing. If granted, the organization will also inform any service provider it has transferred the data to and ensure the service provider has disposed of the information. If the organization refuses to dispose of the individual’s personal information, it must inform the individual of the reason of refusal in writing. It’s also interesting that deidentification has been added to the definition of disposal in the new law.
Special note to federally incorporated businesses: the CPPA amended the Canadian Business Corporation Act so that six years after an individual ceases to be an “individual with significant control,” the corporation must dispose of any of the individual’s personal information in the register within one year. The register of “individuals with significant control” has been a record-keeping requirement for Canadian federal corporations since 2019.
The CPPA also created a new portability right with respect to personal information held by organizations subject to a “data mobility framework.” On the request of an individual, an organization must disclose the personal information it has collected from the individual to another organization designated by the individual if both organizations are subject to a framework.
Finally, the commissioner has a new power to approve a “code of practice” and “certification programs.” Any private or public organization may apply to the commissioner for approval of a code of practice or a certification program that provides substantially the same or greater protection of personal information as the CPPA. However, compliance with the requirements of a code of practice or a certification program does not relieve an organization of its obligations under the law.
The Personal Information and Data Protection Tribunal Act establishes the Personal Information and Data Protection Tribunal to hear appeals of the Privacy Commissioner of Canada’s decisions, orders and recommendations. The tribunal is also given the power to impose penalties under the CPPA. The tribunal consists of three to six full-time or part-time members, and at least three of the members must have experience in the field of information and privacy law.
Although the definition of “automated decision system” in the CPPA includes “artificial intelligence systems” as defined in the AIDA, the focus of the two statutes on this subject is distinct. The CPPA protects individuals’ rights and captures broad, automated decision systems that are not necessarily “autonomous” in predicting outcomes. In other words, the CPPA encompasses sophisticated computational systems with deterministic algorithms. An individual has the right to request an explanation of how a prediction, recommendation or decision having a “significant impact” on them was made.
On the other hand, the AIDA targets “real” AI systems that may be difficult to trace or explain the outcome from the inputs to the system. Some describe this difficulty as the “black box” of AI systems. As explainable AI is difficult to achieve — and many would argue “explainable” does not mean more accurate — governing “real” AI systems will have to rely on the organization’s code of ethics.
The AIDA is principles-based, and industries are expected to comply voluntarily and demonstrate the deployment of “responsible AI.” The purpose of AIDA is two-fold. First, it is to protect Canadians by ensuring “high-impact” AI systems are developed and deployed in a way that identifies, assesses and mitigates the risks of harm and biases. And second, it is to prohibit conduct concerning AI systems that may result in serious harm to individuals or their interests.
The AIDA requires an organization to establish measures with respect to the manner in which data is anonymized and the use or management of anonymized data. There are also record-keeping requirements to demonstrate those measures.
For any “high-impact” AI system, the qualification of “high-impact” remains to be prescribed by regulation. An organization must publish in plain language a description of the system, including how it is used; the types of content it generates and the decisions, recommendations, or predictions it makes; the mitigation measures; and any other information that may be prescribed by regulation.
It is unclear what measures must be implemented to identify and mitigate risks to human health and safety and how to reduce biases relating to AI systems. More clarity may be provided by regulation.
The AIDA prohibits the use of data obtained unlawfully for AI development or where the reckless deployment of AI poses serious harm and where there is fraudulent intent to cause substantial economic loss through its deployment.
Finally, notification to the Minister of Innovation, Science and Industry is required if the use of the AI system is likely to result in material harm.
A senior official called the Artificial Intelligence and Data Commissioner may be designated to assist the minister in the administration and enforcement of the AIDA. Meanwhile, the minister may audit an organization and produce a report at the organization’s expense and make orders where necessary.
An organization found guilty of an indictable offense under the AIDA may be liable for up to $25 million CAD or 5% of global revenue or on summary conviction for up to $20 million CAD or 4% of global revenue. However, an organization cannot be found guilty of an offense if it establishes that it exercised due diligence to prevent the commission of the offense. Note that an organization is vicariously liable for its employee, agent or mandatary.
An individual found guilty of an indictable offense under the AIDA may face a fine in the court’s discretion and/or imprisonment of “up to five years less a day” or, on summary conviction $100,000 CAD and/or imprisonment of up to two years less a day.
The three-pronged Bill C-27 aims to modernize the current federal privacy framework and recognize individuals’ privacy rights and the benefits of data collection and use. PIPEDA was enacted at the turn of the century and has been in effect for the past 20 years; technology has rapidly progressed with the advancements in electronic storage and computing power, enabling Big Data, breakthroughs in artificial intelligence and the wide adoption of digital social platforms. The proposed legislation responds to many of these new changes.
The fate of Bill C-27, however, remains to be seen in the coming months.
nNovation’s Kris Klein, CIPP/C, CIPM, FIP, Anne-Marie Hayden and Shaun Brown contributed to this article.
Photo by Nabil Saleh on Unsplash
Submit for CPEs
If you want to comment on this post, you need to login.
The IAPP is the largest and most comprehensive global information privacy community and resource. Founded in 2000, the IAPP is a not-for-profit organization that helps define, promote and improve the privacy profession globally.
The IAPP is the only place you’ll find a comprehensive body of resources, knowledge and experts to help you navigate the complex landscape of today’s data-driven world. We offer individual, corporate and group memberships, and all members have access to an extensive array of benefits.
© 2022 International Association of Privacy Professionals.
All rights reserved.
Pease International Tradeport, 75 Rochester Ave.
Portsmouth, NH 03801 USA • +1 603.427.9200