In December 2021, the Office of the Privacy Commissioner of Canada (OPC), published its annual report, titled Projecting our values into laws: Laying the foundation for responsible innovation. The report marks the last under the current Privacy Commissioner of Canada, Daniel Therrien whose mandate will come to a close in June 2022.

In the report the OPC highlights the need for a strengthened privacy framework that allows Canadians to participate safely in the digital economy where there is an increasing dependence on the value of data and new technologies. While economic growth and privacy protection are not conflicting values, the OPC cautions that responsible use of Canadian’s personal information is paramount as we move into a sustainable post-pandemic economy. This requires a regulatory framework that reflects Canadian values and ensures the benefits of participating in the digital space do not come at the expense of individual’s rights. To help achieve this, the OPC calls for a move away from the model of self-regulation, to a model of true regulation with “objective and knowable standards adopted democratically, [and] enforced by democratically appointed institutions”.

Building on identified inadequacies of the previously tabled Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts (Bill C-11), the report highlights key issues the OPC wants to see addressed in the modernization of Canada’s federal privacy laws, including:

  1. Enable responsible innovation – define permissible uses of data so as to both enable responsible innovation and protect the rights and values of citizens;
  2. Adopt a rights-based framework – provide organizations with greater flexibility to use personal information, including without consent for legitimate business interests, within a legal framework where privacy is entrenched as a human right;
  3. Increase corporate accountability – clearly define the accountability principle, and provide protective measures such that corporate accountability is real and demonstrable;
  4. Adopt similar principles in public and private sectors laws – given the increased reliance on public-private partnerships, common privacy principles enshrined in both public and private sector privacy laws would help address gaps in accountability where the sectors interact;
  5. Ensure Canadian laws are interoperable, internationally and domestically – help to facilitate and regulate trans-boarder data flows and reassure citizens that their personal information is subject to similar protections across and outside of Canada. It also benefits organizations by reducing compliance costs and increasing competitiveness; and
  6. Adopt quick and effective remedies and increased authority of the OPC – includes giving the OPC the authority to make legally binding orders against offenders and to impose meaningful monetary penalties where warranted.

The report also highlights the importance of considering artificial intelligence (AI) in the modernization of Canada’s federal privacy laws, and points to the public consultation undertaken by the OPC in November 2020. Key recommendations from this included creating the right to meaningful explanation for automated decisions and the right to contest those decisions, as well as requiring organizations to design AI systems from their conception in a way that protects privacy and human rights.

While many of the themes and desired outcomes highlighted in the 2020-2021 annual report are not new, there appears to be a renewed tone of optimism that the Canadian Parliament will be working to enact long overdue updates to Canada’s privacy laws in the near future.