10 Ways Canada’s Consumer Privacy Protection Act Will Impact Privacy Practices

We just posted this on the McInnes Cooper client information site:

10 Ways Canada’s Consumer Privacy Protection Act Will Impact Privacy Practices

November 19, 2020

By Sarah Anderson Dykema, CIPP/C, Lawyer at McInnes Cooper,

David Fraser, Privacy Lawyer | Partner at McInnes Cooper

On November 17, 2020, the federal government proposed dramatic changes to how Canada will enforce privacy law, ushering in a new legal regime to protect individuals’ personal information – and to regulate organizations’ privacy practices. Bill C-11: the Digital Charter Implementation Act creates the Consumer Privacy Protection Act (CPPA) to replace the federal Personal Information and Electronics Documents Act (PIPEDA), and codify in law organizations’ obligations respecting the collection, use and disclosure of personal information rather than merely rely on the Canadian Standard Association (CSA) Model Code. The federal government says it estimates 18 months for the CPPA to go through the legislative process and become law, though this is always difficult to gauge. It might be derailed by, for example, a federal election or the ongoing COVID-19 Pandemic – but it might not.

It’s still early days, but if the CPPA (or some form of it) passes, it will take organizations time to put the necessary compliance processes in place. Here are 10 ways the Consumer Privacy Protection Act will impact organizations’ Canadian privacy practices.

1. Big Penalties. There will be significant penalties for non-compliance with the CPPA. It authorizes administrative monetary penalties and fines of up to 5% of global revenue or $25 million, whichever is higher, for the most serious offences. Currently, PIPEDA only authorizes penalties for breach of the Digital Privacy Act, and those are markedly lower than those under the CPPA: the maximum fine for breaching the Digital Privacy Act is $100,000 per violation (though if there were multiple violations, which would not be uncommon, the fines could add up).

2. Privacy Commissioner Powers. In a move away form the traditional ombudsman model, the CPPA gives the federal Privacy Commissioner broad power to make orders against organizations and to recommend penalties to a new “Personal Information and Data Protection Tribunal”. Under PIPEDA, the Privacy Commissioner only has the power to make recommendations to a breaching organization.

3. New Tribunal. A new “Personal Information and Data Protection Tribunal” will determine and levy any penalties – which will have the effect of a court order – and hear appeals from orders of the Privacy Commissioner.

4. Global Application. The new law takes an expansive approach to applicability, expressly applying to all personal information an organization collects, uses or discloses, including interprovincially or internationally. This reflects the increased digitization and globalization of the global economy, which knows no border, and which the COVID-19 Pandemic has accelerated.

5. New Right of Action. It creates a new privacy breach legal claim. Where the Privacy Commissioner decides an organization violated an individual’s privacy under the CPPA, and the Personal Information and Data Protection Tribunal upholds that finding, that individual can sue the organization (within 2 years) for compensation for the violation.

6. Data Portability & Deletion. It provides for new individual rights of data portability and deletion. Consumers can require an organization to transfer their data to another organization (subject to regulations that aren’t yet available), likely to be a boon to open banking. Individuals can also require that an organization delete the personal information it’s collected about them, subject to some limitations, in what appears to be a limited form of the “right to erasure”.

7. Algorithmic Transparency. It requires algorithmic transparency. Consumers would now have the right to require an organization to explain how an automated decision-making system made a prediction, recommendation or decision.

8. Consent Exceptions. It “simplifies” consent requirements for organizations by making some (potentially broad) exceptions to when an organization must obtain an individual’s consent to the collection, use or disclosure of the individual’s personal information, such as where the use of personal information is core to the delivery of a product or service. This could impact, for example, the information an organization must communicate in a privacy policy.

9. Data De-Identification. It makes new rules around the de-identification of data – including allowing for organizations to use an individual’s personal information without their consent in order to de-identify their data, but appears to limit other uses of de-identified data. Under certain circumstances, organizations can also disclose de-identified data to public entities for socially beneficial purposes.

10. Codes of Practice. It introduces the concept of “Codes of Practice”. The CPPA allows private organizations to establish a “code” and internal certification programs for complying with the law that the Privacy Commissioner will approve. Once approved, the “code” will effectively establish the organization’s legal compliance obligations.

Presentation: Privacy and Cybersecurity - latest trends and legal obligations

I was invited to speak at the 2nd Annual Atlantic Technology Summit on the topic of cybersecurity, privacy and the law. Not surprisingly, the entire conferene this year was online but it was all well attended.

In case it is of interest to others, here's the presentation I gave which started with a few case studies and then an overview of the current environment affecting legal risk. Of course, the slides were prepared before C-11 dropped though I was able to comment during the presenation that the stakes will get even higher with any breach of security safeguards.

Presentation: Little Brother - Surveillance Technology and Privacy Law

I had the pleasure of speaking at the University of New Brunswick Law School's weekly speaker hour, on the topic of non-police use of surveillance technology and how that intersects/collides with Canadian privacy laws. Here are the slides in case it's of wider interest ...

Privacy best practices in a pandemic public health emergency

Since the early days of the COVID-19 pandemic, privacy questions have been in the headlines. International media reported stories from Asia about smartphones being used to enforce quarantine orders. In Ontario, Premier Ford suggested using telecom data to track social isolation compliance and more recently the Quebec police announced that it had arrested a woman in violation of a quarantine order by tracking her down via her cellphone.

Companies are wondering what information they can require from employees about their health, diagnosis or risk factors, and what information they can provide to public health authorities if asked. Companies also have similar questions about customer information.

What privacy laws apply?

Since Canada has a patchwork of privacy laws, the first question is always whether a privacy law applies at all and if so, which one. In Atlantic Canada, public sector employers and “federal works, undertakings and businesses” are subject to privacy regulation for employee information, but the private sector is only covered for customer information. The majority of private-sector employers in Canada (other than in British Columbia, Alberta and Quebec) fall in the gap without privacy regulation for the workplace. Even if no law applies, this does not mean that privacy should be thrown out the window.

Companies should be guided by privacy best practices described below, all of which are embodied in privacy statutes across Canada. These best practices align closely with what employees have come to expect regarding handling of their personal information. Organizations that adopt these principles generally avoid negative reaction from employees that their personal information has been misused. Transparency also encourages honest reporting, as individuals are usually more comfortable with disclosing personal information to an organization that is forthright about how they propose to use the information.

Organizations should be concerned about the relatively new common law causes of action for “intrusion upon seclusion” and “public disclosure of private facts”. Given that health information is particularly sensitive and the irrational stigma that seems to attach to COVID-19 disease, one might allege that disclosing infection risk or status to others may meet the “highly offensive to a reasonable person” threshold for the torts. Applying best practices would minimise the risk of liability.

Balancing privacy with public and occupational health

For employers, what should emerge is a careful balance between privacy principles and legitimate occupational health and safety concerns. The occupational health and safety imperative is a legal one, on both the employer and the employees, as the Occupational Health and Safety Act of Nova Scotia places obligations on both sides to ensure a safe workplace. Given the mode of transmission of the novel coronavirus, employers have a responsibility to keep employees who are at risk of spreading infection out of their workplaces. Some companies have decided to take the temperature of everyone entering the premises and excluding anyone with a fever. Others have adopted questionnaires or mandatory reporting of risk factors. Each of these scenarios involves the collection of personal information, so tread carefully.

What practices to adopt should be informed by the following privacy best practices:

(i) the collection of personal information must be justified, reasonable and non-discriminatory;

(ii) individuals should be given notice of the purposes for the collection, use and disclosure through policy or other direct communications such as signage;

(iii) personal information collected should be restricted to the minimum that is reasonable in the circumstances;

(iv) personal information should only be used for those purposes and should not be disclosed further than necessary; and

(v) the personal information should be accurate, as it will be used to make a decision of whether the employee, contractor or visitor will be permitted to work in the workplace.

What is justifiable and reasonable should be informed by the latest information from public health.

Disclosing personal information to public health authorities

Until recently, public health officials have largely been out of the spotlight, but they have been discreetly and diligently working to contain public health hazards, such as sexually transmitted infections. They are often been given special powers to do so, which includes the ability to require personal information from others. For example, in Nova Scotia, section 15 of the Health Protection Act gives the Chief Medical Officer of Health or his delegate broad powers to order information from third parties. Every privacy law in Canada permits disclosures where required by law and many also permit disclosures where it’s reasonably necessary related to the health and safety of the individual. Obviously, check your local statutes.

That said, we have to be very, very careful about attempts to get data in bulk, such as location data from telcos.

While health and safety are of course top of mind in this pandemic, privacy considerations should also be taken into account.

[Note: This post is based on an upcoming article for the Canadian Bar Association - Nova Scotia's Nova Voce magazine.]

Ontario court adopts the "false light publicity" privacy tort

Regular readers of this (irregular) blog will recall the milestone case of Jones v Tsige, in which the Ontario Court of Appeal imported into Canada the US privacy torts. That list includes:

1. Intrusion upon the plaintiff's seclusion or solitude, or into his private affairs.
2. Public disclosure of embarrassing private facts about the plaintiff.
3. Publicity which places the plaintiff in a false light in the public eye.
4. Appropriation, for the defendant's advantage, of the plaintiff's name or likeness.

The fourth cause of action, commercial appropriation of the plaintiff's image, was already alive and well in Canadian tort law. The Court in Jones applied the "intrusion upon seclusion" tort and subsequent cases have applied "public disclosure of private facts" (See Ontario court explicitly adopts new privacy tort: public disclosure of private facts.)

In December 2019, the Ontario Superior Court of Justice explicitly recognized the "false light" privacy tort. In Yenovkian v. Gulian, 2019 ONSC 7279, Justice Kristjanson was dealing with an unpleasant family law case in which the husband had made wild accusations against his former spouse, particularly related to their two children. The judge noted, with respect to the list of privacy torts:

[170] With these three torts all recognized in Ontario law, the remaining item in the “four-tort catalogue” of causes of action for invasion of privacy is the third, that is, publicity placing the plaintiff in a false light. I hold that this is the case in which this cause of action should be recognized. It is described in § 652E of the Restatement as follows:

Publicity Placing Person in False Light

One who gives publicity to a matter concerning another that places the other before the public in a false light is subject to liability to the other for invasion of his privacy, if

(a) the false light in which the other was placed would be highly offensive to a reasonable person, and

(b) the actor had knowledge of or acted in reckless disregard as to the falsity of the publicized matter and the false light in which the other would be placed.

[171] I adopt this statement of the elements of the tort. I also note the clarification in the Restatement’s commentary on this passage to the effect that, while the publicity giving rise to this cause of action will often be defamatory, defamation is not required. It is enough for the plaintiff to show that a reasonable person would find it highly offensive to be publicly misrepresented as they have been. The wrong is in publicly representing someone, not as worse than they are, but as other than they are. The value at stake is respect for a person’s privacy right to control the way they present themselves to the world.

While I don't propose to list all the misconduct the husband was found to have carried out, this summary at the beginning of the decision is helpful for context:

[2] It is also about a father, Mr. Vem Yenovkian, who has engaged in years of cyberbullying of the mother, Ms. Sonia Gulian on websites, YouTube videos, online petitions and emails. It is about a father who videotapes court-ordered access visits with the children—both in-person and on Skype—and edits and posts those access visits and photographs of the children on the internet, with commentary. It is about a father who publicly posts on YouTube a video of his son cowering under a table while the father harangues him over Skype on a court-ordered access visit. It is about a father who posts videos of him describing his daughter, who suffers from a neurological disorder, as looking drugged, when she used to be “normal,” and posting that his daughter has a “broken” mind.

[3] Despite court orders prohibiting posting, the father continues his cyberbullying campaign abusing Ms. Gulian and her parents. He seeks to undermine the administration of justice through an online campaign to “unseat” a judge of this Honourable Court for rulings made, internet attacks on trial witnesses and the wife’s lawyer, and by flouting court orders and family law disclosure obligations.

The Court in this case did not follow the $20,000 "cap" on non-pecuniary damages set out in Jones v Tsige, but rather followed the divergent train of thought started with the Doe case:

[186] There is no claim for pecuniary damages; the only issue is non-pecuniary damages. The infliction of mental suffering and invasion of privacy are based on many of the same facts.

[187] On damages for intrusion on seclusion, the Court of Appeal in Jones v. Tsige held at paragraphs 87-88 that damages for intrusion upon seclusion in cases where the plaintiff has suffered no pecuniary loss should be modest, in a range up to $20,000. The important distinction with the two invasion of privacy torts in issue here, however, is that intrusion on seclusion does not involve publicity to the outside world: they are damages meant to represent an invasion of the plaintiff’s privacy by the defendant, not the separate and significant harm occasioned by publicity.

[188] The two Jane Doe cases have recognized that the cap on damages for intrusion upon seclusion may not apply to the other forms of invasion of privacy: Jane Doe 2016 at para. 58; Jane Doe 2018 at paras. 127-132. In this case, as is in those, the “modest conventional sum” that might vindicate the “intangible” interest at stake in Jones v. Tsige, para. 71, would not do justice to the harm the plaintiff has suffered.

[189] In Jane Doe 2016, at para. 52, Stinson J. turned to sexual battery cases for guidance in arriving at an award, and Gomery J. in Jane Doe 2018, at paras. 127-128 followed the same approach. In support of this approach, Stinson, J. pointed to the similarly of the psychological and emotional harm the plaintiff had suffered to that experienced by victims of sexual assault.

[190] I likewise adopt the method of looking to the factors applied to decide damage awards for a tort causing harms analogous to those the present plaintiff has suffered for invasion of privacy. The harm arising from the invasion of privacy in the present case is akin to defamation. Accordingly, in arriving at an award of non-pecuniary damages, I am guided by the factors described by Cory J. in Hill v Church of Scientology, at para. 187, which I am adapting to the tort of publicity placing a person a false light:

a) the nature of the false publicity and the circumstances in which it was made,
b) the nature and position of the victim of the false publicity,
c) the possible effects of the false publicity statement upon the life of the plaintiff, and
d) the actions and motivations of the defendant.

[191] In this case, the false publicity is egregious, involving alleged criminal acts including by Ms. Gulian against her children. The false publicity is widely disseminated on the internet, as well as through targeted dissemination to church friends and business associates. Ms. Gulian has suffered damage as a mother, as an employee, in the Armenian community, and in her church community. She is peculiarly vulnerable as the spouse of the disseminator of false publicity. The false publicity has had a detrimental effect on Ms. Gulian’s health and welfare, humiliation, caused her fear, and could be expected as well to affect her social standing and position. Mr. Yenovkian has not apologized, nor has he retracted the outrageous comments despite court orders.

[192] The damages for intentional infliction of mental suffering are intended to be compensatory. I award $50,000 compensatory damages for intentional infliction of mental suffering, relying on Boucher v. Wal-Mart Canada Corp., 2014 ONCA 419.