The Groundhog Day Privacy Bill The Government Waited Months to Bring Back Roughly the Same Privacy Plan!

While Champagne described it is a “historic day”, the bill is better described as a case of Groundhog Day, since it looks an awful lot like the last privacy bill that died with last year’s election call and which never even advanced to the committee stage. I wrote earlier this week about the government’s seeming indifference to privacy and this bill doesn’t do much to change the analysis as the bill raises many of the same questions and will likely face similar opposition.

The last bill – the previous Bill C-11 – was a bill that left many on both sides of the privacy spectrum unhappy. My posts on the bill (here and here) were more positive than most as I saw it as an important start to the reform process, albeit one that raised some serious questions. The bill never gained much traction, however. The Privacy Commissioner of Canada called it “a step back overall” for privacy with particular concerns about the creation of a new privacy tribunal, many in the privacy community worried about weakened consent standards, and the business community signalled unhappiness with new privacy rules on de-identified data. Faced with criticism from all sides, Champagne (who had taken over from Navdeep Bains) decided to do absolutely nothing. The bill languished for months and was clearly never a government priority.

After the election call, the government once again relegated privacy to an after-thought. The new Bill C-11 was placed on a rocket-docket with the government willing to discard democratic norms to get the Online Streaming Act through committee without any debate or discussion. But the introduction of a new privacy bill was left until about a week before the summer break with officials acknowledging that actual legislative progress will have to wait until the fall. There were hints that officials knew the bill was unlikely to spark much excitement: both the technical briefing for journalists and a press conference with Champagne and Justice Minister David Lametti were conducted without the public release of the actual bill, despite the fact it was tabled in the House of Commons hours earlier. After Champagne answered a handful of questions, he left the podium and the bill suddenly appeared online. Funny timing that.

As for the bill itself, there are some changes, including specific provisions on children’s privacy, a clearer distinction between anonymized and de-identified data, more extensive rules around consent exceptions that will still allow organizations to make the case that consent isn’t needed, greater discretion for the Office of the Privacy Commissioner to drop investigations into complaints, and the expansion of a new privacy tribunal to include three members with privacy experience (up from one). These changes will require further analysis, but other areas of controversy – the Privacy Commissioner objected to the tribunal altogether – remain in place. There is also a new bill designed to deal with artificial intelligence that will create new regulatory frameworks that are pretty lightweight when compared to developments in the European Union.

I plan to post more details on the bill in the coming weeks, but in the meantime there is a sense of “once bitten, twice shy” when it comes Bill C-27. Will Champagne and the government be willing to spend political capital to get the bill through the legislative process? Will they be willing to say no to the inevitable lobbying campaign that will seek to water down a bill that the privacy community will want strengthened? Will newly appointed Privacy Commissioner Philippe Dufresne be comfortable standing up to the government by bringing forward the same criticisms as his predecessor? Canadians have waited years for privacy reform and the current government has shown limited interest in the issue. That’s going to need to change for Bill C-27 to provide the trust and security that Champagne claimed yesterday were essential rather than emerge as the latest in a long line of failed Canadian privacy reform initiatives.