Will the second time be the right one? The federal government returned to the charge, earlier last week, by introducing Bill C-27, which aims to protect personal data online. For the former Acting Privacy Commissioner of Canada, said bill is better tied up than its old version, C-11, which died on the order paper before the last election.
What struck me was how responsive the government was to feedback on the old [projet de loi] C-11mentioned Me Chantal Bernier during a telephone interview, referring to the bill tabled Thursday by the Minister of Innovation, Science and Technology, François-Philippe Champagne.
The bill in question aims to give Canadians more control over their personal data. In particular, it provides for fines for digital platforms that do not comply with the new standards for the collection and use of data as well as rules that will govern the use of artificial intelligence.
Me Bernier believes that Bill C-27 is really […] an improved grind of Bill C-11, especiallyshe said, regarding clarification of the definition of de-identified information versus de-identified information.
C-11, inadvertently, with its definition of de-identified information, had essentially adopted a definition of de-identified information. […] Why is this important? Depersonalized information is information whose identifiers have been dissociated from background information, but reversibly, for example by means of a code. […] There is a master list where we can reconcile everythingexplains the lawyer.
Anonymized information, on the other hand, is not personal information, and companies are therefore free to use it for research, innovation, trend analysis… So, as C-11 had adopted a definition of de-identified intelligence that was in fact anonymized, [on] had created a situation where the companies could not have used the anonymized data because of this confusionadds Mr. Bernier, qualifying this clarification as great improvement.
The development of the federal also allows, judges the lawyer, to harmonize the regulations in the matter with the Quebec law.
Protect the young
Another advantage of the new bill, according to Me Bernier: the federal government has taken into account the strong demand to include provisions intended to protect the privacy of minors.
The bill specifically states that minors’ information, whatever it is, is sensitive information.she explains, referring to the need for a express consentan even more limited data retention period, even more rigorous security measures, etc.
In addition, Chantal Bernier underlines the capacity, under the new bill, to apply the legislative provisions as technology evolves.
For five years at the Commissariat, I had to apply [la loi] by virtue of facts that always presented themselves in a different way, where technology always evolved in another direction. The fact that the law was based on principles ensured that it was always relevantshe indicated before pointing out that this aspect has been preserved in Bill C-27.
Balance between citizens and businesses
In addition, the federal government has extended an olive branch to companies by allowing them, in certain circumstances, to collect personal information without the need for the consent of the Internet user.
To do this, the company must demonstrate thatit has a legitimate interest to do soexplains Me Bernier.
However, this flexibility is circumscribed: the organization must make an assessment of whether this collection without consent would have serious privacy implications. If there is an impact, measures must be adopted to mitigate it, and this assessment must be documented and accessible to the Office of the Commissioner.
Everything, says the lawyer, must be done in a context of transparency on the part of the company.
” On the one hand, organizations are given this flexibility, but on the other hand, if they abuse this flexibility, there are obviously consequences. “
Enhanced security
In the wake of concerns expressed at the time of former Bill C-11 about the absence of provisions specifically concerning data theft, Me Bernier believes that Bill C-27 does provide a legal framework to block the way to digital buccaneers.
Now data loss is subject to penalties, but really significant penalties, in the millions of dollars or percentage of annual worldwide revenuesays the lawyer.
Ottawa provides for a fine that could reach a maximum of $25 million or 5% of worldwide revenue, whichever is greater.
The law cannot provide for everything. What the law must impose is the duty of due diligence in data protection. And that, not only does the bill do, but in addition, by attaching significant penalties to contravening this rule, we have just strengthened, in my opinion, the data security protection framework.mentions Me Bernier again.
Bill welcomed
Is Bill C-27 doomed to die on the order paper too? For Me Bernier, the agreement signed between the Liberal Party of Canada and the New Democratic Party to ensure the survival of the Trudeau government should ensure the adoption of the bill.
Another advantage, she says, is that this bill seems to have the support of all parties represented in the Commons.
What about the digital giants? For Google, Facebook and others, after all, collecting personal data is a money printing business model. Already in 2009, Me Bernier recalls, an investigation by the Office of the Commissioner had established that users should expect some use of their data since these are free services.
This bill seems to me to have been fairly responsive to companies, for example with the relaxation surrounding the legitimate interest […] or the question of automated decision-making processes, the scope of which has been restricted. The industry has received accommodations. I expect her to receive this bill positivelyshe adds.
Would it be possible to come up with a “perfect” bill? First, we talk about competing interests: if you ask the industry what a bill without loopholes is, well, it contains almost no limits… If you ask the lawyers to the defense of privacy and the protection of human rights, on the contrary, we absolutely want a framework: it is a fundamental rightlaunches Me Bernier.
This bill strikes me as being concerned with the balance between the needs of companies and the rights of individuals. I sense in this bill – and especially in relation to Bill C-11 – a real balance between the right to privacy of individuals and the needs of companies.she concludes.
Source: Radio-Canada
