The Private Sector Privacy Act: What impact will it have on Canada’s digital sector?
8 March 2023
The Private Sector Privacy Act: What impact will it have on Canada’s digital sector?
Since September 2022, Canada’s Private Sector Privacy Act has undergone changes. Indeed, the Canadian government has recently passed a new bill entitled ‘Bill 64, An Act to modernise legislative provisions relating to the protection of personal information’.
Impact of the Act
As its title suggests, this bill has a significant impact on the legislation governing the protection of personal information applicable to the private sector. The aim of this new Act is to strengthen Canadian citizens’ control over how companies operating in this sector use their data in the course of their business activities. This applies whether these businesses are based in Quebec or outside the province.
It also strengthens citizens’ digital protection by building on the framework already in place through:
- Existing legislation such as the Canadian Anti-Spam Act (CASL), which targets the sending of commercial electronic messages without the recipient’s consent and the installation of software on a computer or network without explicit consent.
This new Act came into force in September 2022 and its implementation will take place over three years, reaching its final form in September 2024.
This legislation draws inspiration from international measures such as the General Data Protection Regulation (GDPR) in Europe and aims to harmonise data usage globally.
Among all the key areas addressed in this draft legislation, three measures have particularly caught our attention due to the undeniable impact their implementation will have on the operations of private-sector businesses:
Every private company will be required to appoint a person to be responsible for the protection of personal data and to publish that person’s title and contact details
The introduction of policies and practices governing the management of personal data, and the publication of detailed information on these in clear and simple terms on the company’s website
Respect for the ‘right to be forgotten’ and the strengthening of explicit consent for all forms of personal data use
Recording of all incidents involving personal data and ensuring that these records can be accessed at any time
Conclusion
Today in Canada, very few companies are complying with the measures introduced by the government. That said, once this bill comes into force, significant financial penalties are to be expected to ensure compliance with the measures adopted. Indeed, financial penalties of up to $10,000,000 or 2 per cent of the company’s global turnover for the previous year are possible (whichever is higher). Furthermore, if the offence is of a criminal nature, the above penalty may also be accompanied by a fine of up to $25,000,000 or 4 per cent of the company’s global turnover (whichever is higher). These penalties will be doubled in the event of a repeat offence.
The situation is therefore urgent, and it would be wise for any company to implement best practices in line with the legal framework.