For years, Canada’s privacy commissioners have warned the country’s decades-old privacy legislation is in urgent need of an overhaul, and that the commissioner’s office requires new tools to properly do its job.
But change hasn’t come quickly — and Daniel Therrien, the current commissioner, says his office is no longer content with waiting for the government to act. So it’s trying a new approach with the powers it currently has.
In his annual report, presented to Parliament on Tuesday, Therrien said his office will soon issue new guidance on how companies should ask Canadians for consent to collect, use, and disclose their personal information. It’s one of a wide range of emerging privacy issues on which his office will begin to issue new or updated guidance on in the coming years.
But more importantly, Therrien will shift some of the resources of the Office of the Privacy Commissioner (OPC) toward a “proactive enforcement model,” launching its own investigations into important issues affecting the privacy of Canadians, rather than merely reacting to individual complaints.
Therrien says that both moves are part of a larger effort to bring more accountability to how companies handle Canadians’ personal information — something Canadians have told the OPC they feel “utterly powerless” to control.
Therrien also reminded Parliament there’s only so much the OPC can do with the powers and resources available to it under what he described as “critically outdated privacy laws.”
“It is not enough for the government to say that privacy is important while taking no systemic measures to protect it,” Therrien wrote in his report, adding that Canadians “do not feel protected by laws that have no teeth, and organizations that are held to no more than non-binding recommendations.”
How to ask for consent
Under current legislation, the privacy commissioner cannot issue binding orders or fines against companies that misuse personal information or ignore its recommendations. Nor can his office launch investigations without reason to believe a violation has occurred, limiting the effectiveness of its proactive enforcement scheme.
Until that changes, Therrien says, his office has been pursuing other means to make companies more accountable and transparent about their practices.
For example, the OPC has spent the last year reviewing its guidance around consent — a foundational component of the Personal Information Protection and Electronic…