Ontario does not have legislation governing the use of personal information by private corporations within the province. Instead, the province relies on the federal Personal Information Protection and Electronic Documents Act (PIPEDA) to govern the collection, use, and disclosure of personal information relating to commercial activity in Ontario. In contrast, Alberta, British Columbia, and Quebec have each enacted legislation to govern the use of personal data in the private sector. 

In 2020, the federal government introduced Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make related and consequential amendments to other Acts (Bill C-11). The Bill would have expanded the scope of the Office of the Privacy Commissioner’s powers, potentially introduced a new regulatory regime, and increased penalties for companies found to be non-compliant with the law. Bill C-11 was tabled when the federal election was called, however, it could be revived in the future. 

Daniel Therrien, Privacy Commissioner of Canada, viewed the Bill as a “step back both for consumer protection and economic growth”. Instead, Therrien proposed a new provincial regime to better protect the information of consumers in today’s increasingly digital world. Back in June, the province released a white paper suggesting ways to strengthen privacy protections in the province and sought feedback from the public on the proposals. 

Below, we will look at proposals the provincial government is considering, including those endorsed by the Privacy Commissioner, and how they might impact corporate liability going forward. 

Proposed Federal Privacy Law Changes Set Out in Bill C-11

As part of the now-tabled Bill, the federal government planned several significant reforms to federal privacy law, enacting the Consumer Privacy Protection Act, and establishing a new body to oversee privacy disputes at the federal level. These proposed changes include: 

1. A new regulatory body: the Bill proposed creating a new tribunal, the Personal Information and Data Protection Tribunal. The Tribunal would hear complaints and take recommendations from the Privacy Commissioner regarding fines and penalties for organizations found to be non-compliant.
2. The right to appeal: both organizations and individual complainants would have a right to appeal decisions of the new tribunal within 30 days of the decision, or an order made according to a decision. The Tribunal could allow or dismiss the appeal, as well as substitute a new finding or order. 
3. Increased penalties for organizations: Organizations that were found guilty of an indictable offence under the new law would be subject to a fine not exceeding $25 million, in addition to 5% of the organization’s revenue in the prior fiscal year. Summary convictions could result in a fine of $20 million and 4% of the organization’s gross revenue. 

Since the Bill has been set aside due to the election, these changes have been tabled. In the future, however, the Bill could be revived or form the basis for a new attempt to reform the federal privacy scheme. 

Ontario Sets Sights on Provincial Privacy Reform

In a White Paper released in June, the province set out several considerations for privacy reform at the provincial level. The changes are meant to address the following:

• Offer more control to individuals over how their personal information is collected, used, shared, and stored by private sector companies;
• Offer better protection to vulnerable groups such as children; and
• Built better trust in the digital age.

The proposal involves increasing oversight and enforcement powers of the provincial Privacy Commissioner while also offering supports to organizations. Notably, the White Paper indicates increased penalties for offending organizations similar to those proposed under Bill C-11. For instance, there is a penalty of up to $25 million and 5% of a company’s gross revenue for failing to report a breach of security or failing to abide by a compliance order.

Ontario’s Information and Privacy Commissioner endorsed the idea of a provincial privacy regime to oversee data usage in the private sector. She wishes to see a law expanding protections for Ontarians by including the following individuals and organizations who are not covered by federal privacy laws currently:

• Employees working for provincially regulated companies
• Charitable organizations
• Unions
• Professional associations
• Provincial political parties

Noting that over 85% of the province’s GDP is created by small and medium-sized businesses, Ontario’s Information and Privacy Commissioner said, “compliance in a manner better suited to the unique experiences and challenges of smaller businesses”. She also believes the Information and Privacy Commissioner is “well-equipped to support local organizations by providing practical guidance materials and impactful advisory services that reflect the day-to-day realities of doing business in our province”. 

Ontario Chamber of Commerce Opposes Provincial Regime

In a statement released by the Ontario Chamber of Commerce, senior policy manager Claudia Dessanti stated the Chamber’s members are anxious about the potential change to a provincial regulatory scheme in Ontario:

“Our position has long been privacy regulation of businesses should be at the federal level. PIPEDA is national for a reason: Businesses that operate across Canada cannot navigate different sets of rules. It’s a lot of red tape, it’s a lot of uncertainty and cost, and it deters them from investing in Canada.”

The province has already indicated that if a provincial law were to come into force, there would be an opportunity to exempt businesses conducting commercial activity in Ontario from PIPEDA. For those organizations with interests in multiple provinces, the province would make efforts to harmonize laws to enable enforcement cooperation between the various schemes. 

Contact Milosevic & Associates in Toronto for Reliable Advice on Regulatory Issues

If you are facing regulatory charges and require representation before a tribunal, agency, or other administrative body or in court, the litigation lawyers at Milosevic & Associates can help. We help clients simplify what can otherwise be a highly complex situation through administrative dispute resolution or litigation. We excel at finding creative and cost-effective solutions to regulatory issues including health and safety matters, securities, and environmental concerns. To discuss your matter with a member of our team, call us at 416-916-1387 or contact us online.