Unpacking the roles and responsibilities under Canada's proposed Protecting Privacy and Consumer Data Act

Bill C-36, Canada’s proposed Protecting Privacy and Consumer Data Act aims to do two broad things. It proposes substantive reforms to the existing private sector data protection regime contained in the Personal Information Protection and Electronic Documents Act (PIPEDA). It also replaces the oversight and enforcement regime with a new one. Since rights are only as good as their oversight and enforcement, the changes are significant and are the subject of this post.

In brief, Bill C-36 will replace the current oversight and enforcement regime (led by the Privacy Commissioner of Canada who is an independent agent of Parliament) with one under the Digital Safety and Data Protection Commission of Canada. It will assign different roles to different actors within that new structure in an attempt to separate oversight, enforcement, and review functions. The focus of this post is on understanding who the actors will be and what responsibilities they will have.

The New Structure

Oversight and enforcement of the new privacy bill will reside with the Digital Safety and Data Protection Commission of Canada. This is a five-person body known as the ‘Commission’ created by Bill C-34, the proposed Digital Safety Act (DSA). The Commission, whose full-time members will be appointed by the Governor in Council, and who will hold office for renewable terms of up to five years (DSCCA, s. 11), is established by the Digital Safety Commission of Canada Act (DSCCA). The DSCCA is part of Bill C-34. Some aspects of the Commission proposed the DSCCA will be amended by Bill C-36, if it passes, to adapt it to its new role with respect to privacy. The Commission will have a role under both the DSA and the Protecting Privacy and Consumer Data Act. One significant change, therefore, is that oversight roles for different aspects of digital policy will be in the hands of the same regulator.

Bill C-36 assigns functions to a new Privacy and Consumer Data Commissioner, who is referred to in the Act as the ‘Commissioner’. In this post I will refer to this role as the PCDC to avoid confusion with the ‘Commission’. The PCDC will be a member of the Commission other than the Chairperson. They will be designated by the Governor in Council to fill the PCDC role (s. 85(1)).

Bill C-36 also creates a new Privacy and Consumer Data Division (the Division). This consists of the PCDC and “at least one other member of the Commission assigned by the Commission” (s. 89(1)).

The two other actors with roles under Bill C-36 are the Minister (the Minister of Industry if no other Minister is designated), and the Governor in Council (the executive branch of government). Note that the minister designated by default in Bill C-34 is the Minister of Heritage, while the default minister under Bill C-36 is the Minister of Industry. It remains to be seen which Minister will be designated as the responsible Minister under the combined scheme.

Roles

The government has created a rather complex governance structure under Bill C-36. PIPEDA relies on an ombuds-style approach to oversight, with the Privacy Commissioner essentially developing guidance, investigating complaints, and making findings and recommendations. Under, PIPEDA, the Commissioner has no order-making powers – an application to Federal Court is required for any binding orders to issue. The Federal Court conducts hearings de novo and makes its own findings. This separates the broader oversight and investigative functions of the Commissioner from any binding outcomes. Under Bill C-36, with the Commission having powers to make orders and impose potentially substantial administrative monetary penalties (AMPs), the government has attempted to separate guidance functions from investigation and investigation from ultimate enforcement. The separation, of course, is within a five-person Commission that will all share a microwave and coffee maker, although recourse to the Federal Court is still available for appeals of decisions or orders of the Commission (s. 126(1)).

The Cast of Characters

The Commission

The Commission exercises the policy and guidance roles under Bill C-36. These are, for the most part, functions currently performed by the Privacy Commissioner of Canada under PIPEDA. The Commission will be responsible for developing and conducting public information programs (s. 76(c)(i)); developing guidance materials and tools for organizations in relation to compliance (s. 76(c)(ii)); undertaking and publishing research regarding the protection of personal information; and undertaking and publishing any research relating to the operation or implementation of the legislation that is requested by the Minister (s. 76(d)(iv)).

Bill C-36 envisages a more active role for the Commission in providing advice to organizations. Because under PIPEDA the Privacy Commissioner of Canada holds policy and guidance roles as well as exercising oversight and investigative functions, it was perhaps considered problematic that they provide guidance directly to organizations. They currently provide advice and assistance, but it does not go as far as what Bill C-36 envisages. This potential conflict is shared by other Canadian privacy commissioners. Consider how the tension between advising and regulating is specifically addressed in Ontario’s Personal Health Information Protection Act (PHIPA):

66. The Commissioner may, [. . . ]

(d) on the request of a health information custodian, offer comments on the custodian’s actual or proposed information practices. [My emphasis.]

This allows for Ontario’s Commissioner to provide comments – but nothing more. It does not guarantee that a separate complaint investigation will not result in a finding that the approach adopted is in breach of PHIPA. Under Bill C-36, the Commission will be empowered to provide guidance and to recommend corrective measures relating to an organization’s privacy management program on their own initiative (s. 10). Alternatively, under s. 76(c)(v), they may (in the form and manner they consider appropriate) provide guidance on an organization’s privacy management programs at the request of the organization, and they may recommend corrective measures in relation to this program. Although, as is explained below, it is the PCDC and not the Commission that investigates complaints (and one of those complaints could be about a privacy management program that has been corrected according to the recommendations of the Commission), it is still the Commission that sits in review of the outcomes of that investigation. There is the potential here for deals reached on privacy management practices to be resistant to the complaints process.

The Commission will consult with federal government institutions respecting codes of practice or certification programs (s. 76(b)). It is also charged with promoting “by any other means that the Commission considers appropriate, the purpose of this Act” (s. 76(c)(vi)).

Under s. 78 of Bill C-36, the Commission must make information “readily available” about how the Commission, the PCDC and the Division exercise their powers under the Act. In order to do so, it is charged with developing guidance material – in consultation with the Minister and stakeholders – regarding “the exercise or performance of the powers, duties and functions of the Commission, the Commissioner and the Division in relation to enforcement and dispute resolution under the Act” (s. 78(2)). This includes decisions to initiate a complaint, how the complaint will be handled (including decisions to initiate or discontinue investigations and the conduct of proceedings), dispute resolution mechanisms, compliance agreements, proposed orders and compliance orders, the AMP scheme and audits. The Commission must make this information “available in a form or manner that it considers appropriate” (s. 78(3)). Under s. 79, the Commission can also enter into an agreement or arrangement with the Minister relating to the administration of the Act.

The Commission is also the body responsible for entering into agreements with or coordinating activities with the Canadian Radio-television and Telecommunications Commission and the Competition Bureau or any other entity set out in regulations. It can undertake and publish research on issues of mutual interest. One goal of these collaborations is to promote “regulatory consistency” (s. 80).

The Commission may consult with provincial data protection counterparts to ensure consistency of the manner of protection of personal information. It will be able to enter into agreements, conduct complaints of mutual interest, carry out joint research, and develop joint guidelines. It will also be able to develop model contracts or other documents with these counterparts relating to personal information that is collected, used or disclosed interprovincially or internationally (s. 81).

It is also the Commission that will be charged with collaborating with international privacy regulators. It will be empowered to disclose specified information to an international counterpart in relation to investigations, proceedings, interim orders or audits. It will have the authority to collaborate internationally in other ways with its international counterparts, including through research, knowledge sharing activities, and the identification of priorities and issues of mutual interest (s. 82).

The Commission will produce an annual report on the exercise of powers and performance of the Commission, the Commissioner and the Division, the application of the Act, and the substantial similarity of any provincial legislation (s. 83).

The Commission will play an important new role with respect to enforcement of obligations. The PCDC can only propose an order in a notice of contravention relating to obligations under the legislation or undertaken in a compliance agreement. It is the Commission, however, that makes the actual order if there is no application for review (s. 107(6), s. 208(1)(g), s. 108(6)). If there is an application for review (s. 109(1)), the Commission can hold a hearing (s. 109(2)) and can issue a decision (s. 110) which “may confirm, cancel or vary any determination that is the subject of proceedings”. It can also issue an order. The Commission has the power to issue interim orders during the course of review proceedings (s. 121(1)). Although the PCDC is actually a member of the Commission, the Bill specifies that they cannot participate in a review proceeding (s. 111(2)). The Commission’ s powers on review are set out in s. 121(2).

The Commission may delegate certain of its powers to “any of its members, the Division, or a division of the Commission”, with some restrictions. The Commission’s powers to set the rules regarding procedures and practices under the Act cannot be delegated except to the PCDC or the Division. Delegated powers must also not include the powers to make decisions on review, to make interim orders, or to review interim orders made by the PCDC, unless the powers are delegated “to one or more members of the Commission other than the Commissioner” (s. 84(3)).

The Commissioner

The Commissioner (referred to here as the PCDC) is a member of the Commission (other than the Chairperson), according to s. 85(1).

The PCDC has duties related to certification programs. They can request information from or cooperate with an entity operating an approved certification program, and they can recommend the withdrawal of an organization’s certification and can revoke approval of a certification program (s. 85(2)), in accordance with criteria established in regulations.

The PCDC can receive complaints regarding contraventions of Part 1 of the Act (s. 97(1)) or can initiate a complaint (s. 97(2)). They have the power to investigate under s. 98, as well as the power to discontinue an investigation (s. 100). The range of the PCDC’s investigatory powers are set out in s. 122. These powers include the power to issue a notice of a proposed interim order in exigent circumstances. The PCDC is obliged to notify parties of the outcomes of complaints (s. 104). It is interesting to note that under PIPEDA, the Commissioner has one year from the date of filing of a complaint to issue a report (PIPEDA, s. 13(1)). Although the timelines are meant to ensure there is no great backlog of unresolved complaints, the one-year timeline has proven challenging, particularly where investigations are complex or involve multiple regulators. Timelines for complaint resolution are entirely absent from Bill C-36.

In terms of enforcement, the PCDC can issue a notice of contravention of obligations under the law (s. 105). It can also enter into a compliance agreement with an organization under s. 102 any time after the initiation of an investigation. Noncompliance with a compliance agreement can lead the PCDC to issue a notice of contravention (s. 106). Notices of contravention can contain a proposed order and/or penalty. These can be challenged (with challenges heard by the Commission as described above). If they are not challenged, they become binding (s. 108(6)) by order of the Commission. The PCDC is also empowered to conduct audits under s. 118, and to report on these (s. 119).

The Division

The Division consists of the PCDC and at least one other member of the Commission assigned by the Commission (s. 89). The Division is responsible for approving codes of practice (s. 92(3)) according to criteria set out in the regulations and can also approve a certification program (s. 93).

The Division can authorize an organization to use de-identified personal information to re-identify an individual for a specific purpose or in a specific situation, if it is in the interests of the individual (s. 138).

The Division may attempt to resolve a complaint through alternate dispute resolution methods (s. 101).

The Minister

As noted earlier, the Minister of Industry is the “Minister” under the Act unless another minister is designated by the Governor in Council. The Minister plays a greater role under C-36 than under PIPEDA. This is due to the fact that the current Privacy Commissioner of Canada is an independent agent of Parliament, and there is less scope for intervention by the Minister in the operations of that office. This will change under Bill C-36.

The Minister will be able to request that the Commission develop guidance materials and tools, undertake research on the protection of personal information, or on the operation or implementation of the Act (s. 76). Under PIPEDA, the Minister simply has the authority to request research (PIPEDA, s. 24(b)).

Under s. 78(2) of Bill C-36, the Minister will consult with the Commission on the development of guidance material “respecting the exercise or performance of the powers, duties and functions of the Commission, the Commissioner and the Division in relation to enforcement and dispute resolution under this Act”. The Minister may also enter into an agreement with the Commission relating to the administration of the Act (s. 79). The Minister has extensive regulation-making powers under s. 142 that relate to codes of conduct and certification programs.

The Governor in Council (cabinet)

Under Bill C-36, it is the Governor in Council that designates who will serve as the PCDC (s. 85). The Governor in Council also has regulation making powers under s. 139 regarding a broad range of issues under the Act. These include anonymization of personal information, disposal of personal information, security safeguards, information on data breach documentation requirements, the right of access of individuals to their personal information, or anything else to be prescribed under the legislation. The Governor in Council can also make regulations regarding both the criteria and the procedures for determining whether that provincial legislation is substantially similar to the Act (s. 139(3)). The Governor in Council is also responsible for making regulations regarding the disclosure of personal information under a data mobility framework established under s. 72 of the Act.

In Bill C-36 the government has created a new and complicated oversight and enforcement regime that is intended to create greater separation between policy and guidance, investigative, and enforcement roles. This desire for separation between the different functions will be one of the (less convincing) justifications advanced for shifting from an independent agent of Parliament to the proposed model. The new system creates separation through the allocation of different functions to different members of a five-person Commission which itself exercises policy, guidance, and enforcement functions. It is not clear that the end result will be much different in practical effect from the ways in which other privacy commissioners with both investigative and adjudicative functions have organized their offices to keep these roles separate and to avoid conflicts. There are clearly other things going on with this bill – and these will be the subject of subsequent posts.