The federal government is proposing to introduce a combination of fines and restrictions on data collection for companies that violate privacy laws, unveiling more details of a “digital charter” aimed at reining in the growing power of Silicon Valley tech giants.
In a speech to the Empire Club of Canada in Toronto Tuesday, Innovation Minister Navdeep Bains outlined a series of principles to guide future legislation for data protection and online privacy. They include proposals for more transparency into how companies collect and use personal information and stronger rights for consumers to consent to the use of their data or move it between companies and services.
Prime Minister Justin Trudeau announced his government’s digital charter last week during a meeting of tech executives and world leaders in Paris, suggesting that it would tackle issues such as hate speech, misinformation and election interference on the internet.
Ottawa’s plans focus mainly on updating Canada’s decades-old privacy legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA), to give the Office of the Privacy Commissioner greater enforcement powers.
The proposal comes with few specifics about potential financial penalties or the kinds of behaviour that would trigger a fine. Mr. Bains pointed to regulations Ottawa introduced last fall to address data breaches that include fines of $10,000 to $100,000 for every incident. But he suggested the government could look to a broader set of penalties for the most serious privacy violations.
“When I say significant fines, I’m talking about a percentage of revenue,” he said. “I’m talking about really limiting your ability to collect data or collect revenue through ads. Serious, significant, meaningful fines as a consequence for not really protecting privacy.”
The government’s plans also include a review of the Statistics Act to ensure personal data is handled properly by Statistics Canada, as well as an update to the Privacy Act, which governs how federal institutions use personal information. Other proposals include the use of data trusts – trusted third parties that can control access to personal data to be used by academics and companies for research and innovation – as well as an examination of how data is used by algorithms in automated decision-making to, for instance, provide mortgages or credit. Political parties are not subject to the privacy laws under review.
Canadian politicians have taken to framing the country’s economy with a focus on digital innovation, although critics have argued that Canada has for too long allowed large multinational firms to trample homegrown companies while monetizing personal data. The protection of such data, meanwhile, has moved to the fore of public discourse as tech companies deal with accusations of misuse, such as the revelations that British consulting firm Cambridge Analytica had been able to access data on millions of Facebook users for political profiling. The federal government’s calls for tougher privacy laws come after Privacy Commissioner Daniel Therrien said his office would sue Facebook in federal court to enforce the findings of an investigation into the Cambridge Analytica scandal.
Mr. Bains said the government was aiming to strike a balance between protecting consumer privacy and promoting innovation by Canadian companies. He said his office has written to federal Commissioner of Competition Matthew Boswell to examine whether Canada’s antitrust laws are strong enough to prevent large “data monopolies” from putting small and medium-sized businesses at a disadvantage.
But with little more than a month before Parliament breaks for the summer, the proposals come with no new legislation or any concrete timeline. Innovation, Science and Economic Development Canada said the government was aiming to introduce new legislation after the federal election in October.
Ann Cavoukian, a former privacy commissioner of Ontario who now heads the Privacy by Design Centre of Excellence at Ryerson University, said the government needs to act quickly. “We have to make this real and we’ve got to do it before the election,” she said. “I would urge the government to move now. They have the means of doing it.”
The digital charter represents a good first step, said Jim Hinton, a Waterloo, Ont., patent lawyer. But missing from the discussion are efforts to keep Canadian-made intellectual property, which underpins the digital economy, from leaving the country. “Especially for Canadian companies and Canada generally, we don’t control this technology," he said. "And if we don’t control this technology, then it doesn’t matter what our legislation or market mechanisms say.”
The principles Mr. Bains outlined on Tuesday emerged from months of consultations, beginning last June, to develop a national data strategy. They will also include recommendations to modernize the government’s digital services and position Canada as a leader in using artificial intelligence for the pubic good, as well as penalties and fines for organizations that breach the principles.
While Canadian digital-privacy laws are considered more forward-thinking than those of the United States, they are widely seen to be lagging behind the European Union General Data Protection Regulation (GDPR), which was brought into force last year. Asked by The Globe and Mail why Canada opted to focus on principles instead of matching the European legislative standards, Mr. Bains insisted that the PIPEDA was “interoperable” and compatible with the GDPR.
Josh O’Kane
Tamsin McMahon