Showing posts with label Bill C-12. Show all posts
Showing posts with label Bill C-12. Show all posts

Tuesday, October 23, 2012

Bill C-12, PIPEDA amendments referred to committee (see correction)

It appears that Bill C-12 is being dusted off and will be sent to committee:
Order Paper and Notice Paper No. 167

C-12 — September 29, 2011 — The Minister of Industry and Minister of State (Agriculture) — Second reading and reference to the Standing Committee on Industry, Science and Technology of Bill C-12An Act to amend the Personal Information Protection and Electronic Documents Act.

Correction: Apparently it has not been referred to committee yet. It has been "on the order paper" to do so for some time, but the status of C-12 has not changed. Thanks to Jason Kee for pointing this out.

Managing and responding to data breaches

This morning I had the pleasure of speaking at the High Technology Investigation Association (Atlantic Chapter) annual professional development event. I was asked to speak about managing and responding to data breaches, particularly in light of the upcoming data breach notification requirements expected to be added to PIPEDA under Bill C-12 (currently languishing in Parliament).

Here's the presentation for anyone who may be interested:

Wednesday, June 06, 2012

Why the heel-dragging on privacy law revision?

I was interviewed yesterday by Sarah Schmidt of Postmedia News about why the Harper Government appears to be dragging their heels on implementing Bill C-12 or kicking off the next mandatory five year review of PIPEDA.

Her interview with the Commissioner, Jennifer Stoddart, and me also focused on the Commissioner's apparent abandonment of the ombudsman model in favour of the ability to issue orders and to levy fines.

Feds dragging their heels on fixing privacy law: Stoddart

OTTAWA — Canada's privacy watchdog says she's "very, very disappointed" by the federal government's failure to update a law meant to protect the personal information of consumers.

Jennifer Stoddart's annual report on the private-sector privacy law, tabled Tuesday in the House of Commons, highlights how evolving technologies are creating new privacy risks for youth.

The report also flags how Parliament is required, every five years, to review the Personal Information Protection and Electronic Documents Act (PIPEDA), but the latest review, which was scheduled for 2011, but has yet to be launched. Meanwhile, amendments to the law, tabled last fall, are outdated already, says the report calling for new powers for the Office of the Privacy Commissioner.

"I am very, very disappointed that we're not moving ahead with privacy reform issues. They're long overdue," Stoddart said in an interview after the tabling of the report.

Under the current law, Stoddart has no power to impose any fines and companies are not required to report breaches to her office.

The proposed amendments tabled last fall do not include powers to impose fines, but do include a provision for mandatory reporting to the privacy commissioner if a company experiences a material breach. The bill, known as C-12, has not moved beyond first reading, which took place on Sept. 29, 2011.

"What is put there, I think, was current about three years ago, but in the meantime the world has moved on. I really think, like in most jurisdictions now, we need some sanctions for egregious data breaches." said Stoddart.

"We have to have powers that will be respected by these huge multinational corporations that are doing business online and you need a strong voice to be heard by them."

Pointing to the fact that the government's anti-spam law is still not in effect, despite its passage last year, Stoddard added: "There's a slowness that is hard to understand in this digital age."

David Fraser, a Halifax-based lawyer specializing in privacy laws, said it's "puzzling" the recommendations arising from the 2006 PIPEDA review process have not been enacted.

"They really come up with something that by all measures is a bit of a no-brainer."

Fraser said the government's decision to not begin the second PIPEDA review in 2011 makes more sense if the Tories aren't interested in discussing Stoddart's push for more powers, given how "significant" the proposal is.

"During the last review, the privacy commissioner was fine with being an ombudsman, not have order-making powers and using persuasiveness and co-operation and collaboration to get companies to change their practices," said Fraser.

"More recently, and including in her annual report, she's making noises about looking for additional powers, particularly the ability to levy fines and perhaps issue orders. And that is a significant change — not only a significant change in the approach of her office, which has consistently advocated the ombudsman position for 15 years, but it would make a significant change in the legislation. It may not be a discussion the government wants to have right now," added Fraser, who leads McInnes Cooper's Privacy Practice Group.

Industry Minister Christian Paradis declined to answer questions put to him about why C-12 has stalled in Parliament, the delay in the 2011 PIPEDA review, and Stoddart's push for more powers.

In a statement, Paradis said the government is "building a modern legal framework that will enhance consumer confidence in the online marketplace and support the growth of Canada's digital economy. The Personal Information Protection and Electronic Documents Act underwent a review that led to the drafting of Bill C-12, which is currently before Parliament."

Wednesday, December 07, 2011

Bill C-12: Redline of proposed amendments to PIPEDA

Later today, I'm going to be giving a presentation with Lisa Lifshitz from Gowlings on the proposed amendments to the Personal Information Protection and Electronic Documents Act (AKA C-29), which are stagnating at first reading stage in Parliament. I'll be referring to the redline that I've prepared which shows the amendments in place and is a handy reference. Anyone who wants a copy is welcome to it as well: PIPEDA Amdended to include FISA, C-29 and C-12 (Google Doc).

Thursday, November 24, 2011

Bill C-12 and “lawful authority” under PIPEDA

Phillipa Lawson has a very well thought out post over at Slaw on "lawful authority" under PIPEDA and the ability of businesses to share personal information with law enforcement. Check it out: Bill C-12 and “lawful authority” under PIPEDA — Slaw.

Thursday, September 29, 2011

Government reintroduces PIPEDA amendments

This just in:

The Digital Economy in Canada - Reintroduction of amendments to the Personal Information Protection and Electronic Documents Act

On September 29,2011, the Government of Canada reintroduced enhancements to private sector privacy legislation in a bill seeking to amend the Personal Information Protection and Electronic Documents Act (PIPEDA).

This Bill, entitled the Safeguarding Canadians' Personal Information Act, implements the government's October 2007 Response to the Report of the Standing Committee on Access to Information, Privacy and Ethics arising from the first Parliamentary review of the Act. The Government Response addressed each of the 25 recommendations contained in the Committee's report and committed to amending the Act in agreement with many of the Committee's recommendations.

Bill C-12 includes provisions to better protect and empower consumers, clarify and streamline rules for business, and enable effective investigations by law enforcement and security agencies. Canada already has a solid legislative framework in place to ensure the protection of personal information. The majority of the proposed amendments seek to "fine-tune" the legislation and update it to reflect changes in markets and technology.