Privacy Round-Up (Volume 22)
In this Edition of the Round-Up:
Latest AccessPrivacy Offerings
Federal private sector privacy law reform is accelerating, as Bill C-27, the Digital Charter Implementation Act, 2022, passed its second reading. Parliament voted to refer all three parts of Bill C-27 for consideration by the Standing Committee on Industry and Technology (INDU);
The AccessPrivacy team has prepared a number of key resources on Bill C-27, including a clause-by-clause annotation of the proposed Consumer Privacy Protection Act (CPPA), with comparisons to PIPEDA and detailed commentary on key sections;
Privacy legislative reform will be a key theme at our 11th Annual AccessPrivacy Conference, which will be held in Toronto on June 7. Register today!
Ontario’s Information and Privacy Commissioner has recommended amendments to the Ontario government’s proposed Bill 60 (Your Health Act, 2023), via a letter to the Chair of the Standing Committee on Social Policy. Among other things, the proposed bill would allow regulated health care workers from other provinces and territories to work in Ontario “As of Right” without first registering with one of Ontario’s regulatory colleges. The Commissioner recommends clarifying the application of key requirements under the Personal Health Information Protection Act in such circumstances. For further details on Bill 60, see recent Osler publications here and here.
Case Law Updates
In a major win for Facebook, the Privacy Commissioner of Canada’s application alleging that Facebook breached the Personal Information Protection and Electronic Documents Act (PIPEDA) by sharing users’ personal information with third-party apps was dismissed by the Federal Court. The application for a de novo judicial proceeding followed a joint investigation by the Office of the Privacy Commissioner of Canada (OPC) and the Office of the Privacy Commissioner for British Columbia (OIPC BC) into Facebook’s data sharing with a third-party app that had subsequently disclosed the information to Cambridge Analytica;
Although the joint investigation’s 2019 Report of Findings had concluded that Facebook had breached PIPEDA and BC’s Personal Information Protection Act, the Federal Court found a lack of evidence led by the Commissioner to support a finding that Facebook had breached its safeguarding obligations (which end once information is disclosed to third-party apps) or failed to obtain adequate consent;
A decision certifying a new class action in British Columbia provides updated guidance regarding an employer’s vicarious liability for breaches of privacy resulting from an employee’s conduct. The case involved an employee who had secretly collected explicit photos and video of young female employees while they were in the washroom. The application judge was satisfied that, under the circumstances, the plaintiffs’ case supported a cause of action for the employer’s vicarious liability;
This certification decision follows an August 2022 judgment in a BC class action finding that an employer was vicariously liable for damages caused by its employee’s breaches of the provincial Privacy Act. This decision, along with other notable recent privacy cases, was discussed in the November 2022 AccessPrivacy Data Litigation Roundtable.
Regulatory Authority Updates
An investigation into ChatGPT, the company behind an artificial intelligence-powered chatbot, has been launched by the OPC. The investigation follows a complaint that the company collected, used, and disclosed users’ personal information without consent;
A new fact sheet aimed at informing teens about the privacy risks of sexting has been published by the OPC. As reported in volume 21 of the Round-Up, sharing of intimate images is also the subject of new legislative proposals in British Columbia;
An investigation into the Alberta Energy Regulator (AER) has been launched by the Information and Privacy Commissioner of Alberta. The investigation will focus on AER’s compliance with the province’s public sector Freedom of Information and Protection of Privacy Act and, specifically, whether the organization had a duty to disclose information about the tailings pond leak from Imperial’s Kearl Oil Sands Project;
Privacy Commissioner of Canada Philippe Dufresne has made submissions to Minister of Innovation, Science and Industry François-Philippe Champagne regarding the reform of Canada’s Competition Act. Commissioner Dufresne’s submission is intended to “ensure that privacy considerations are factored into potential reforms of Canada’s national competition policy”;
- The Canadian Radio-Television and Communications Commission has updated its Frequently Asked Questions about Canada’s Anti-Spam Legislation (CASL). The document provides general information about (among other things) when CASL applies, issues relating to consent, and requirements for unsubscribe mechanisms.
Latest AccessPrivacy Offerings
Please join members of the AccessPrivacy team and The Interactive Advertising Bureau of Canada for an in-person workshop on Wednesday, May 3, where we will examine and assess the potential impacts of Quebec's Law 25 on the online advertising industry. Registration is open here;
Come visit the AccessPrivacy booth on May 25 and 26 at the IAPP Canada Privacy Symposium 2023. Chat with our team members about AccessPrivacy, receive a code for a free 30-day trial subscription, grab an AccessPrivacy Swag Bag and pick up some informative privacy law materials;
As noted above, AccessPrivacy is proud to announce that our 11th Annual Conference will be held on Wednesday, June 7, 2023. Registration is now open via the AccessPrivacy Event Page!
As with past years, our in-person conference in our Toronto offices will bring together leading privacy professionals and thought leaders from across Canada for a day of insightful panel discussions about a wide range of topics, including:
- Reflections on Canadian Privacy Legislative Reform and the Proposed Regulation of Artificial Intelligence Systems
- Facilitating Data Ethics and Responsible Personal Information Processing
- Civil Society and Academic Perspectives on Emerging Developments in the Canadian Privacy and Data Arena
- Treatment of Anonymized and De-identified Data in Proposed Legislative Schemes: A Canadian Anonymization Network Panel
- Privacy Commissioners Roundtable
- Complex Data Sharing Arrangements and Emerging Data Governance Models: Lessons Learned from the Health Sector
- Osler Data Litigation Thought Leadership Roundtable
- And more!
Confirmed guest panelists include:
- Martin Abrams, Chief Policy Innovation Officer at The Information Accountability Foundation (IAF)
- Bojana Bellamy, President of the Centre for Information Policy Leadership (CIPL)
- Rosario Cartagena, Chief Privacy and Legal Officer/Corporate Secretary at the Institute for Clinical Evaluative Sciences (ICES)
- Abigail Carter-Langford, Vice President, Governance, Risk and Compliance & Chief Privacy Officer at Canada Health Infoway
- Dr. Khaled El Emam, Canada Research Chair in Medical AI, University of Ottawa; Co-founder and CEO of Replica Analytics
- Keren Groll, Senior Special Counsel, Privacy & Data Innovation at TD Bank
- Brent Homan, Deputy Commissioner, Compliance at the Office of the Privacy Commissioner of Canada
- Patricia Kosseim, Information and Privacy Commissioner of Ontario
- Nadine Letson, Head of Corporate, External and Legal Affairs at Microsoft
- Brenda McPhail, Director, Privacy, Technology & Surveillance Program at the Canadian Civil Liberties Association (CCLA)
- Dr. Eric Meslin, President and CEO of the Council of Canadian Academies
- Suzanne Morin, VP Enterprise Conduct, Data Ethics and Chief Privacy Officer at Sun Life
- Dr. Teresa Scassa, Canada Research Chair in Information Law and Policy, University of Ottawa
- Pamela Snively, Chief Data and Trust Officer at TELUS Communications
- Cara-Lynn Stelmack, Assistant Commissioner, Operations and Compliance at the Office of the Information and Privacy Commissioner of Alberta
- Jeannette Van Den Bulk, Deputy Commissioner at the Office of the Information and Privacy Commissioner for British Columbia;
- We continue to update our various Private Sector Topic Hubs to thematically incorporate upcoming Quebec obligations introduced by Law 25 (formerly Bill 64) in force September 2023 and September 2024. This is in addition to our many key documents regarding Quebec legislative reform more broadly, which can be found in our comprehensive Legislative Reform Portal.
Sign up for AccessPrivacy's complimentary e-news updates to receive each edition of the Round-Up by email. The archive of past editions of the Privacy Round-Up is available to AccessPrivacy Knowledge Portal subscribers.
Please note: if you are having issues opening links to publicly available materials, please try clearing your browser cache (including cookies and files) before clicking the link again.