By: Emily Laidlaw

PDF Version: Canada’s Proposed New Consumer Privacy Protection Act: The Good, the Bad, the Missed Opportunities

Bill Commented On: Bill C-11, Digital Charter Implementation Act, 2020, 2nd Sess, 43rd Parl, 2020 (first reading 17 November 2020)

On November 17, 2020, the Federal Government unveiled the most sweeping consumer privacy law reform in the last twenty years with the proposed Digital Charter Implementation Act, 2020 (Bill C-11).  The Act would repeal and replace parts of the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (PIPEDA) with a new private sector privacy statute, the Consumer Privacy Protection Act (CPPA) (not to be confused with the well-known California Consumer Protection Act (CCPA)), and would enact the Personal Information and Data Protection Tribunal Act (Tribunal Act). The Bill makes good strides in modernizing Canada’s privacy legislation. It is also, in the end, a missed opportunity for more profound law reform.

If passed, it will necessitate modernization of Alberta’s Personal Information Protection Act, SA 2003, c P-6.5 (PIPA). PIPA is designated substantially similar legislation, meaning that PIPA rather than PIPEDA regulates personal information within our provincial borders (and through our ombudsman, the Office of the Information and Privacy Commissioner of Alberta). Without this designation, PIPEDA would apply to all consumer privacy transactions within Alberta. As will be detailed below, Bill C-11 fundamental revamps consumer privacy legislation and therefore unless Alberta follows suit, it is highly unlikely the substantially similar designation can be maintained.

Continue reading →

By: Emily Laidlaw

PDF Version: A Right to be Forgotten Online: A Response to the Office of the Privacy Commissioner Draft Position

Document Commented On: Draft OPC Position on Online Reputation

The Office of the Privacy Commissioner (OPC) published its draft position on online reputation last week stating that the Personal Information Protection and Electronic Documents Act, SC 2000, c-5 (PIPEDA) provides a right to de-index search results (remove a link to a webpage from search results based on a keyword search) and a right to source takedown (removal of a webpage from the host site). De-indexing and source takedown are specific ways that a person might deploy a right to be forgotten, an issue hotly debated for several years, but especially since the Court of Justice of the European Union decided Google Spain SL, Google Inc v Agencia Espanola de Proeccion de Datos (AEPD), Marios Costeja Gonzalez, (2014) Case C-131/12 (known as Google Spain). Scholars have already responded to the OPC, such as here, here and here. I offer a different commentary, reflecting my first critical thoughts on three key issues arising from the report: (a) the public interest test suggested by the OPC to balance freedom of expression and privacy; (b) the role of private technology companies; and (c) the blurring of the line between data protection and defamation regimes. While I will discuss source takedown briefly (and for a more thorough analysis of intermediary liability and defamation law, see my work with Dr. Hilary Young here), the focus in this post will largely be on search results.  Continue reading →