ETHI Committee Prepares for GDPR Adequacy Assessment in New Report on PIPEDA

Éloïse Gratton March 13, 2018

Europe and Canada Flag Puzzle Pieces

Preparations for the upcoming entry into force of the European General Data Protection Regulation (“GDPR”) are underway in Canada’s House of Commons. On February 28, 2018, the Standing Committee on Access to Information, Privacy and Ethics (“ETHI” or “Committee”) presented its report on the review of the Personal Information Protection and Electronic Documents Act (“PIPEDA”), entitled “Towards Privacy by Design” to the House of Commons.

As its name indicates, this report recommends that the review of PIPEDA by the Government of Canada be guided by the concept of “privacy by design,” which is the idea that privacy considerations should be taken into account at all stages of the development of a product. Accordingly, the Committee put forward numerous suggestions aimed at reinforcing PIPEDA, with a clearly stated goal of ensuring that it will be considered adequate by the European Union in the context of the coming into force of the GDPR in May.

The ETHI made 19 recommendations to potentially update the protection of personal information framework in Canada. This bulletin will focus on the most important recommendations for organizations doing business in Canada, which are as follows:

  • Moving towards an opt-in consent as the default for uses of personal information for secondary purposes;
  • Considering amending PIPEDA to clarify situations where personal information can be used to satisfy legitimate business interests;
  • Examining the best ways to protect depersonalized data;
  • Recognizing a right to erasure and a right to de-indexing, at a minimum for minors;
  • Giving the Office of the Privacy Commissioner of Canada (“OPC”) stronger enforcement powers, including the power to make orders and impose fines for non-compliance, as well as broad audit powers, including the ability to choose which complaints to investigate.

This new report gives a preview of what the upcoming amendments to PIPEDA could look like. In some cases, these amendments may be inspired by the upcoming new European privacy protection framework, especially in light of the Commissioner Therrien’s statement before the ETHI that reassessing PIPEDA’s adequacy status “is a pressing issue with possible far-ranging implications for Canada’s trade relationship with the EU.”

To read our bulletin on this topic, click here.

This content has been updated on March 13, 2018 at 19 h 08 min.