Adam Kardash, Michael Fekete
Mar 2, 2022
Québec’s Bill 64, which introduced sweeping changes to the province’s private sector privacy regime when it received Royal Assent last September, was the first domino to fall in a series of expected and significant privacy legislative reforms across Canada. With several jurisdictions across the country preparing to follow suit, Osler partners Adam Kardash, Privacy and Data Management, and Michael Fekete, Technology, provided an update on Bill 64’s implementation and reform developments across the country in an AccessPrivacy call on March 2.
The first phase of Bill 64 will come into force in September 2022. By then, organizations will have to designate a privacy officer with specific qualifications and comply with Québec’s mandatory security breach reporting regime, among other accountability requirements. In January, the province’s privacy regulatory authority (Commission d’accès à l’information, or CAI) stated that organizations should support their appointed privacy officers with the human, technical and financial resources necessary to ensure the success of their compliance programs.
While many organizations’ programs already comply with the security breach notification requirements under federal legislation, the European GDPR, and other regimes, Bill 64’s use of the term “confidentiality incident” will require some careful attention and may apply to a broader set of security breaches. In his experience, Adam says that even seemingly minor differences in wording can prove very impactful, and will be even more important given the potential of new, severe penalties for non-compliance. Further guidance is expected from the CAI in the coming months.
A replacement for the federal government’s Bill C-11, which died on the Order Paper with last fall’s election, will likely be the next domino to fall. Privacy legislative reform remains a high priority for the current Liberal government, and recent consultations with privacy experts seem to point to a tweaking of the earlier bill. A firm timeline is unclear, but some expect to see a bill being tabled early this fall.
In British Columbia this past December, a special committee delivered 34 recommendations to modernize the province’s private sector privacy law, stressing the importance of harmonizing it with federal, international and other provincial laws. Alberta has also solicited feedback on the topic of legislative reform, after its Information and Privacy Commissioner proposed amendments to its private sector privacy law in November 2020, mirroring potential changes in other jurisdictions. Changes in Alberta are expected eventually, but most likely after other provinces. Finally, given the upcoming provincial election this spring, the development of a private sector privacy law in Ontario has been sidelined for now.
Watch the Webinar on Demand