Wednesday, June 06, 2012

Why the heel-dragging on privacy law revision?

I was interviewed yesterday by Sarah Schmidt of Postmedia News about why the Harper Government appears to be dragging their heels on implementing Bill C-12 or kicking off the next mandatory five year review of PIPEDA.

Her interview with the Commissioner, Jennifer Stoddart, and me also focused on the Commissioner's apparent abandonment of the ombudsman model in favour of the ability to issue orders and to levy fines.

Feds dragging their heels on fixing privacy law: Stoddart

OTTAWA — Canada's privacy watchdog says she's "very, very disappointed" by the federal government's failure to update a law meant to protect the personal information of consumers.

Jennifer Stoddart's annual report on the private-sector privacy law, tabled Tuesday in the House of Commons, highlights how evolving technologies are creating new privacy risks for youth.

The report also flags how Parliament is required, every five years, to review the Personal Information Protection and Electronic Documents Act (PIPEDA), but the latest review, which was scheduled for 2011, but has yet to be launched. Meanwhile, amendments to the law, tabled last fall, are outdated already, says the report calling for new powers for the Office of the Privacy Commissioner.

"I am very, very disappointed that we're not moving ahead with privacy reform issues. They're long overdue," Stoddart said in an interview after the tabling of the report.

Under the current law, Stoddart has no power to impose any fines and companies are not required to report breaches to her office.

The proposed amendments tabled last fall do not include powers to impose fines, but do include a provision for mandatory reporting to the privacy commissioner if a company experiences a material breach. The bill, known as C-12, has not moved beyond first reading, which took place on Sept. 29, 2011.

"What is put there, I think, was current about three years ago, but in the meantime the world has moved on. I really think, like in most jurisdictions now, we need some sanctions for egregious data breaches." said Stoddart.

"We have to have powers that will be respected by these huge multinational corporations that are doing business online and you need a strong voice to be heard by them."

Pointing to the fact that the government's anti-spam law is still not in effect, despite its passage last year, Stoddard added: "There's a slowness that is hard to understand in this digital age."

David Fraser, a Halifax-based lawyer specializing in privacy laws, said it's "puzzling" the recommendations arising from the 2006 PIPEDA review process have not been enacted.

"They really come up with something that by all measures is a bit of a no-brainer."

Fraser said the government's decision to not begin the second PIPEDA review in 2011 makes more sense if the Tories aren't interested in discussing Stoddart's push for more powers, given how "significant" the proposal is.

"During the last review, the privacy commissioner was fine with being an ombudsman, not have order-making powers and using persuasiveness and co-operation and collaboration to get companies to change their practices," said Fraser.

"More recently, and including in her annual report, she's making noises about looking for additional powers, particularly the ability to levy fines and perhaps issue orders. And that is a significant change — not only a significant change in the approach of her office, which has consistently advocated the ombudsman position for 15 years, but it would make a significant change in the legislation. It may not be a discussion the government wants to have right now," added Fraser, who leads McInnes Cooper's Privacy Practice Group.

Industry Minister Christian Paradis declined to answer questions put to him about why C-12 has stalled in Parliament, the delay in the 2011 PIPEDA review, and Stoddart's push for more powers.

In a statement, Paradis said the government is "building a modern legal framework that will enhance consumer confidence in the online marketplace and support the growth of Canada's digital economy. The Personal Information Protection and Electronic Documents Act underwent a review that led to the drafting of Bill C-12, which is currently before Parliament."

No comments: