Bill summary: Digital Charter Implementation Act, 2020

The Government of Canada has tabled the Digital Charter Implementation Act, 2020 to strengthen privacy protections for Canadians as they engage in commercial activities. The Act will create the Consumer Privacy Protection Act (CPPA), which will modernize Canada's existing private sector privacy law, and will also create the new Personal information and Data Protection Tribunal Act, which will create the Personal Information and Data Tribunal, an entity that can impose administrative monetary penalties for privacy violations. Finally, the Act will repeal Part 2 of the existing Personal Information Protection and Electronic Documents Act (PIPEDA) and turn it into stand-alone legislation, the Electronic Documents Act. With each of these steps, the government is building a Canada where citizens have confidence that their data is safe and privacy is respected, while unlocking innovation that promotes a strong economy.

• Changes enabled by CPPA will enhance individuals' control over their personal information, such as by requesting its deletion, creating new data mobility rights that promote consumer choice and innovation, and by creating new transparency requirements over uses of personal information in areas such as artificial intelligence systems.
• CPPA will also promote responsible innovation by reducing regulatory burden. A new exception to consent will address standard business practices; a new regime to clarify how organizations are to handle de-identified personal information, and another new exception to consent to allow organizations to disclose personal information for socially beneficial purposes, such as public health research, for example.
• The new legislative changes will strengthen privacy enforcement and oversight in a manner similar to certain provinces and some of Canada's foreign trading partners. It does so by: granting the Office of the Privacy Commissioner of Canada (OPC) order-making powers, which can compel organizations to comply with the law; force them to stop certain improper activities or uses of personal information; and order organizations to preserve information relevant to an OPC investigation. The new law will also enable administrative monetary penalties for serious contraventions of the law, subject to a maximum penalty of 3% of global revenues.
• The introduction of the Personal Information and Data Tribunal Act will establish a new Data Tribunal, which will be responsible for determining whether to assign administrative monetary penalties that are recommended by the OPC following its investigations, determining the amount of any penalties and will also hear appeals of OPC orders and decisions. The Tribunal will provide for access to justice and contribute to the further development of privacy expertise by providing expeditious reviews of the OPC's orders.
• The Electronic Documents Act will take the electronic documents provisions of PIPEDA and enact them in standalone legislation. This change will simplify federal privacy laws and will better align the federal electronic documents regime to support service delivery initiatives by the Treasury Board Secretariat.