Canada’s private sector privacy law is more than 25 years old and there is broad consensus that a modernization is long overdue. Bill C-36, tabled on Monday, is the government’s third attempt at updating the law, following the failed efforts with Bill C-11 in 2020 and Bill C-27 in 2022. My first post on the new bill focused on what I think remains both the most important development and the biggest mistake: the decision to push the Privacy Commissioner of Canada out of private-sector privacy and to place the file with an overloaded digital safety commission. For years, privacy critics have argued that, given the absence of order-making powers or serious penalties, Canada’s biggest shortcoming has been weak enforcement. Yet just as the government adds much-needed new rights and penalties to the privacy law framework, it undermines enforcement once again by introducing a new regulator that will take years to establish. The consequence is that, rather than updating the law for 2027, it is updating it for 2030 or later.
Wiertz Sebastien - Privacy by Sebastien Wiertz (CC BY 2.0) https://flic.kr/p/ahk6nh
Privacy
Gary Anandasangaree’s Vic Toews Moment Shows the Government Has Lost Its Way on Lawful Access
As the government prepares to shut down debate on lawful access and push Bill C-22 through committee without even discussing or debating dozens of potential amendments, Public Safety Minister Gary Anandasangaree’s responded by saying it was time for opposition parties to “choose” whether to stand with law enforcement and victims of crime. The response was telling as it evoked a similar response to another lawful access debate in 2012. At that time, the Conservatives were in power and Vic Toews was the Public Safety Minister. Toews infamously had the following exchange with Liberal MP Francis Scarpaleggia, who is now the Speaker of the House.
Government Moves to Shut Down Lawful Access Hearing In Order To Fast Track Passing the Bill This Week
The government is planning to shut down hearings into Bill C-22, the lawful access bill, with no further debate or discussion on potential amendments to the bill. It has just placed a motion on the Order Paper that would limit today’s committee meeting to only 30 minutes for standard clause-by-clause review. After that, it plans to cancel all further debate or discussion on any other amendments. The committee will instead be required to vote on all remaining amendments with no further debate, discussions or questions to officials. In fact, the substance of the amendments will remain secret and will not even be disclosed to the public. The government’s intent is clearly to complete clause-by-clause review tonight to ensure that the bill passes through the House of Commons by the end of the week
Yesterday, the government introduced privacy reforms that shuts down the Privacy Commissioner of Canada’s role in private sector privacy regulation. Today, it is shutting down hearings into one of the biggest privacy threats in years. Public Safety Minister Gary Anandasangaree had committed to amendments during the lawful access hearings, but this move means that only secret government amendments that will not be made public during the hearing will pass. Opposition parties have submitted many amendments based on testimony from the Privacy Commissioner, bar associations, security companies, and privacy experts. These include potential changes to the rules on mandatory metadata retention, risks to security and encryption, and privacy safeguards. All of these amendments will not even be made public, much less open to debate and discussion. Weeks of hearings and public concern tossed aside by the government in a rush to shut down debate and consideration of amendments to a deeply flawed, risky legislative plan.
Canada’s Digital Super-Regulator: Bill C-36 Pushes Out the Privacy Commissioner and Hands Private Sector Privacy to an Overloaded Commission
In the last act of an incredibly intense digital policy stretch, the government today tabled new private sector privacy legislation in the form of Bill C-36, the Protecting Privacy and Consumer Data Act. It is a big bill, and my initial take will be divided into two: this post will focus on the seismic shift the bill creates for privacy administration and enforcement, and a second post (hopefully tomorrow) will discuss the substantive changes and additions. I start with the enforcement side because the most consequential feature of C-36 is the question of who will administer the rules. The bill firmly cements the Digital Safety Commission as a new digital super-regulator in Canada, stripping the Privacy Commissioner of authority over private sector privacy law and handing it instead to the same five-member commission the government created a few days ago to police online harms. I believe the approach is unprecedented among peer countries and will have negative repercussions for Canada’s standing in the privacy world. Indeed, removing an Agent of Parliament from private-sector privacy enforcement after decades isn’t something you tuck into a lengthy bill, but rather requires extended public consultation and analysis on how best to ensure Canada has effective privacy enforcement. This is a stunning abrogation of good policy development and a poorly conceived vision of the breadth and importance of privacy.
Privacy as a Fundamental Right? The Government’s Terrible Privacy Track Record Suggests Virtue Signalling Over a Genuine Commitment
The government is set to introduce its long-promised privacy reform legislation early this week, with the recognition of a fundamental right to privacy expected to serve as a foundational element of the bill. Establishing privacy as a fundamental right would be a welcome and long-overdue development, one that many have called for and that was set to be added to Bill C-27, the prior attempt at privacy reform. Yet the framing is difficult to square with the government’s actual record on privacy, which over the past year has involved a steady stream of privacy-invasive measures that leave the fundamental rights rhetoric feeling more like virtue signalling than a genuine commitment. Simply put, the government cannot credibly claim to treat privacy as a fundamental right while actively undermining that right through a series of other bills and efforts to sideline the Privacy Commissioner of Canada.
Recent Posts
The Lessons of 9/11 We Forgot After October 7th 
Named to Canadian Lawyer’s Top 25 Most Influential Lawyers 
Be Careful What You Wish For: Why Asking Google Maps to Defy the U.S. on Lake Ontario Would Undermine Canadian Digital Sovereignty 
Big Money, Bigger Design Changes: What the Meta Settlement Means for Canada, Bill C-34, and the Age Verification and Privacy Risks That Remain 
Unleashing the Trolls: Ontario Court Opens the Door to Liability for Influencers Who Weaponize Their Audiences
