Privacy Commissioner of Canada Jennifer Stoddart this morning set out her office’s goals for PIPEDA reform. The last attempt to reform the private sector privacy law stalled in the House of Commons with Bill C-12 still technically alive (having been sitting at second reading for months) but destined to die once the government hits the legislative reset button in the summer. The five-year mandatory review of PIPEDA is now years behind schedule, so Stoddart’s attempt to kick-start the process is a welcome development.
The PIPEDA report focuses on four areas of reform: stronger enforcement powers, mandatory security breach disclosure, increased transparency on personal information disclosures, and heightened accountability. In particular, the OPC is calling for:
- Reform PIPEDA to provide for stronger enforcement powers. These could include statutory damages (administered by the Federal Court); or giving the Commissioner the power to make orders; or affording the Commissioner with the power to impose administrative monetary penalties; or a combination of the above;
- Require organizations to report breaches of personal information to the Commissioner and to notify affected individuals, where warranted, so that appropriate mitigating measures can be taken in a timely manner;
- Require organizations to publicly report on the number of disclosures they make to law enforcement under paragraph 7(3)(c.1), without knowledge or consent, and without judicial warrant, in order to shed light on the frequency and use of this extraordinary exception; and
- Modify the accountability principle in Schedule 1 to include a requirement for organizations to demonstrate accountability upon request; to incorporate the concept of â€œenforceable agreementsâ€; and to make certain accountability provisions subject to review by the Federal Court.
The report is a great start, but will require leadership from the Minister of Industry that has to date been absent.