What are the main arguments highlighted by the IPC in support of the proposal?

For the most part, the IPC commented on the Government's proposal favourably and goes on to note that privacy rights would be better protected with a provincial privacy law that is substantially similar to the current regime but goes beyond the limit of the Personal Information Protection and Electronic Documents Act of 2000 ('PIPEDA'), Bill C-11 for the Digital Charter Implementation Act, or whatever reform bill which may be introduced in the future. Please note, as a result of the dissolution of Parliament for the recent Canadian federal elections, Bill C-11 will need to be reintroduced. Imran Ahmed, Partner and Head of Technology, Co-Chair Data Protection, Privacy & Cybersecurity and Tiana Corovic, Associate, outlined some of the main points highlighted by the IPC in support of the proposal:

"1. Filling jurisdictional gaps
Until Ontario enacts legislation that is substantially similar to […] [PIPEDA], companies in Ontario will continue to be regulated under federal law.

The IPC views Ontario's proposed private sector privacy law as an opportunity to build on existing PIPEDA principles, while closing some of its legislative gaps. Specifically, the IPC supports the government's proposal to (a) provide special protections for youth and children, (b) protect employees in provincially regulated companies from employer surveillance, and (c) regulate not-for-profits that, despite their non-commercial activities, may collect large quantities of personal information that otherwise fall outside the ambit of PIPEDA.

2. Operational efficiency
The IPC views the white paper's comprehensive framework as an opportunity to address various business and technology needs specific to Ontario. For example, without a substantially similar law, PIPEDA applies uniformly to the 'full spectrum of Canadian businesses', from corporate giants to start-up businesses despite having different levels of privacy risk. In reality, small- and medium- sized businesses make up approximately 98% of Ontario's businesses. By giving the IPC discretionary authority to develop sector-specific guidelines and certification programs, Ontarians could benefit from a more contextualised enforcement regime compared to its federal counterpart.

3. Inter-sectoral integration
In light of the increasing reliance on third party providers and growing information processing chains, the IPC commends Ontario's proposal to create a 'seamless' data regulatory environment that addresses cross-sector needs within a single regulatory scheme."

How does the proposal compare to other provincial private sector privacy laws?

Canadian privacy legislation reform continues to be a high priority over the past two years and as such other provinces are also looking to strengthen their laws. In particular, Alberta's Office of the Information and Privacy Commissioner of Alberta ('OIPC') called for comments on ways to modernise its Personal Information Protection Act ('PIPA'). Similarly, in British Colombia the Special Committee to Review the Personal Information Protection Act ('the Special Committee') held public hearings earlier this year following its consultation for the Personal Information Protection Act, SBC 2003 c 63. Finally, just recently, on 22 September 2021, Quebec's Bill 64, An Act to modernize legislative provisions as regards the protection of personal information ('Bill 64') received royal assent. Ahmed and Corovic discuss some potential gaps in the Ontario government's white paper and the laws in British Colombia and Quebec.

• "Regulation of political parties: Given the potential for misuse of personal information in election campaigns, the IPC suggested expanding the scope of the proposed private sector privacy law to include political parties under the regime, similar to what is already in place in British Columbia and Quebec.
• Implementing de-indexing requirements: The IPC stressed a need to consider including a de-indexing requirement, otherwise known as the 'right to be forgotten', modelled after Quebec's Bill 64. Under this scheme, users have the right to request that online content is not linked to their name through search engines. This requirement would give Ontarians more autonomy and control over their online reputation and avoid having inaccurate, outdated or simply embarrassing information attached to their name."

How will a private sector law in Ontario impact the enactment of a reformed federal law in Canada?

As highlighted in its response, the IPC believes that an Ontario private sector privacy law should go further than the current regulatory regime in Canada and explicitly beyond the scope of the now failed Bill C-11. Ahmed and Corovic detail how a robust Ontario private sector law could impact the enactment of a reformed federal law in Canada.

Specifically, Ahmed and Corovic stated, "The IPC highlighted a number of strengths and weakness in the federal privacy sector – including PIPEDA and its proposed replacement, Bill C-11 that ultimately died on the table. These differences could very well fuel discussions for federal reform in the future. With advancing technology, increased cyber breaches and international pressures, changes to the federal privacy legislative framework is not a far-fetched idea despite the untimely demise of Bill C-11."

Ahmed and Corovic further provided, "The following key changes may make its way into the federal privacy legislative framework:

• Youth and children: The IPC sees Ontario's future privacy law as an opportunity to fill in federal gaps to protect youth and children. With the widespread use of social media among all age groups and emerging smart toys that collect data to personalise user experience, federal reform is likely to follow suit and codify a special subset of rules to protect its most vulnerable citizens.
• Fairness requirement: Ontario's proposal includes a fairness requirement that is currently absent from PIPEDA and Bill C-11. This added criteria strengthens a privacy framework by ensuring an individual’s personal data is not processed in a way that is detrimental, discriminatory, unexpected, or misleading. The white paper noted that 'fairness' would reinforce a 'citizen-oriented interpretation of the law' that is on par with Canada's earlier strides to recognise privacy as a fundamental right.
• Strengthening the enforcement regime: In its response, the IPC highlighted the enforcement options under Bill C-11 as one of its 'most significant weaknesses'. Examples of future enforcement regimes may include designing a flexible and efficient dispute resolution mechanism that is handled by a single body.
• Data portability & inter-sectoral integration: Similar to Bill C-11, Ontario is seeking to include sector-specific standards to facilitate the movement of data between organisations while also recognising varying privacy risks based on the size and operational scope of a business. Additionally, the use of various parties to transfer personal information in a processing chain is only gaining traction that will further put pressure on the current federal regulatory framework to adopt a more contextual approach."

Moreover, Ahmed and Corovic highlighted, "In its response, the IPC examines Ontario's proposed private sector privacy law through a critical lens taking into account age groups that are increasingly affected by advancing technology, multi-level data transfers and a cross-comparison against Canada's existing private sector privacy laws. To remain competitive in the privacy sector, the federal government will likely adopt some of the IPC's broader recommendations in future federal reform bills instead of re-inventing the wheel."

What's next

Ontario is relatively early in the reform process and a bill has not yet been drafted. However, when compared to the federal Bill C-11, provinces tend to take a swifter approach as evidenced by Quebec's Bill 64 which was enacted in under two years following its introduction in the legislature.

Edidiong Udoh Privacy Analyst
[email protected]

Comments provided by:
Imran Ahmed Partner, Head of Technology, Co-Chair Data Protection, Privacy & Cybersecurity
[email protected]
Norton Rose Fulbright LLP, Toronto

Tiana Corovic Associate
[email protected]
Norton Rose Fulbright LLP, Toronto

1. See: https://www.ipc.on.ca/wp-content/uploads/2021/09/2021-09-03-ipc-comments-on-gov-white-paper_modernizing-privacy-in-ontario.pdf
2. See: https://www.ontariocanada.com/registry/view.do?postingId=37468&language=en