Bill C-27, the Digital Charter Implementation Act, was introduced in the Canadian House of Commons on June 16, 2022, passed first and second readings, and is currently before the Standing Committee on Industry and Technology.
If it becomes law, Bill C-27 will apply to every organization across Canada (federally or provincially regulated) with respect to personal information the organization collects, uses, or discloses in the course of commercial activity.[1] Bill C-27 will also apply to a federally regulated organization with respect to personal information about an employee or job applicant.
Bill C-27 will enact:
- The Consumer Privacy Protection Act (“CPPA”).
- The Personal Information and Data Protection Tribunal Act (“PIDPTA”).
- The Artificial Intelligence & Data Act (“AIDA”).
The information in this briefing note is a summary only. To learn more and for assistance preparing for Bill C-27, please contact your Sherrard Kuzz lawyer or our team at info@sherrardkuzz.com.
- Consumer Privacy Protection Act
CPPA will replace Part 1 of the Personal Information Protection and Electronic Documents Act (“PIPEDA”) as follows:
- CPPA will require every organization to implement a privacy management program to include policies, practices, and procedures respecting: the protection of personal information; requests for information and complaints; staff training; and explanatory materials.
- CPPA (similar to PIPEDA) will require an organization to collect, use or disclose information only for “appropriate purposes.” Under CPPA, the following factors must be taken into account to determine whether a purpose is appropriate: the sensitivity of the personal information; the legitimate business needs of the organization; and whether an individual’s loss of privacy is proportionate to the benefits of the collection, use or disclosure.
- Under CPPA, consent will only be valid if an individual is provided with the following information: the purpose, manner, and consequences of the collection, the use or disclosure of their personal information; and information regarding third party disclosure.
- Under PIPEDA, an individual has the right to access and rectify their personal information, and to withdraw their consent at any time. Under CPPA, an individual has the additional right to seek the disposal of and transfer of personal information.
- CPPA will create a private cause of action allowing an individual who has been harmed by an organization’s contravention of CPPA to seek damages from the organization in certain circumstances.
- CPPA will allow the Privacy Commissioner of Canada to impose an administrative monetary penalty:
- of up to the greater of 3% of an organization’s gross global revenue or $10 million, or
- of up to the greater of 5% of an organization’s gross global revenue or $25 million for certain serious contraventions.
- Personal Information and Data Protection Tribunal Act
PIDPTA will establish the “Personal Information and Data Protection Tribunal.” This tribunal will hear appeals of decisions made by the Privacy Commissioner of Canada and will have the power to make orders and/or impose penalties.
- Artificial Intelligence & Data Act
AIDA will regulate the development and operation of artificial intelligence systems (“AI”) in the private sector. AIDA will establish specific rules by regulation to ensure “high-impact AI” – which will likely include AI used for employment screening – meets safety and human rights standards. Note that AIDA will apply to an entity that (a) makes AI or manages its operations or (b) processes data or makes data available for making or using AI. AIDA will not apply to the end user of AI.
The information contained in this briefing note is provided for general information purposes only and does not constitute legal or other professional advice, nor does accessing this information create a lawyer-client relationship. This briefing note is current as of August 2024 and applies only to Ontario, Canada, or such other laws of Canada as expressly indicated. Information about the law is checked for legal accuracy as at the date the briefing note is prepared but may become outdated as laws or policies change. For clarification or for legal or other professional assistance please contact Sherrard Kuzz LLP.
[1] In British Columbia, Alberta and Quebec, provincial privacy legislation may apply instead of CPPA, in some circumstances.
