Osler, Hoskin & Harcourt LLP

June 29, 2023 - Health Sector, Private Sector, Public Sector

Privacy Round-Up (Volume 23)

In this Edition of the Round-Up:

Legislative Updates

Case Law Updates

Regulatory Authority Updates

What's New with AccessPrivacy?

Legislative Updates

  • Despite referring to proposed federal statutory reform as “a step in the right direction”, the Office of the Privacy Commissioner of Canada (OPC) has released 15 key recommendations for Bill C-27, the federal Digital Charter Implementation Act, 2022. The list of recommendations, which are further detailed and accompanied by proposed amendments in the OPC’s submission to the parliamentary Standing Committee on Industry and Technology (INDU), include statutorily recognizing privacy as a fundamental right, strengthening the framework for de-identified and anonymized information, and expanding the list of violations qualifying for the imposition of potentially severe financial penalties;

  • Privacy Commissioner of Canada Philippe Dufresne discussed privacy elements of the proposed amendments to the Canada Elections Act in an appearance before the Standing Senate Committee on Legal and Constitutional Affairs. The Commissioner noted that the proposed amendments “do not establish minimum privacy requirements for political parties to follow…[and] would allow political parties and their affiliates to collect, use, retain, disclose, and dispose of personal information in accordance with the party’s own privacy policy”. The Commissioner emphasized that meaningful privacy obligations and independent oversight should apply to political parties;

  • Information and Privacy Commissioner of Ontario Patricia Kosseim has published two letters to the Chair of the Standing Committee on Justice Policy, outlining her privacy-oriented recommendations for Ontario’s proposed Strengthening Safety and Modernizing Justice Act. The first letter relates to amendments to Ontario’s Coroner’s Act and the second letter to proposed changes to the Community Safety and Policing Act, 2019.

Case Law Updates

Regulatory Authority Updates

Quebec

Federal

  • A special report on pandemic-related public sector privacy investigations has been tabled by the OPC in Parliament. The report concludes that measures such as the government's collection and use of mobility data, vaccine mandates for domestic and international travel, and the ArriveCan program "complied with relevant privacy laws and were necessary and proportional in response to the unprecedented public health crisis”, but that transparency could have been improved in certain respects;

    • The OPC's decision following its investigation into the collection and use of de-identified network mobility data by the Public Health Authority of Canada (PHAC) was the subject of the June AccessPrivacy Monthly Call, which is available for on-demand viewing; 

  • A joint investigation into OpenAI, the artificial intelligence company that operates ChatGPT, has been announced by the OPC and will be conducted in conjunction with the privacy regulatory authorities in Alberta, British Columbia, and Quebec. The investigation will examine whether OpenAI has (i) obtained valid and meaningful consent for processing Canadians’ personal information, (ii) complied with various privacy obligations including with respect to transparency and accuracy; (iii) processed personal information for reasonable purposes, and (iv) respected data minimization principles;

  • Guidance on workplace privacy for employers subject to federal privacy legislation has been updated by the OPC. The guidance sets out key concepts such as when employee monitoring is allowed and if employees can waive privacy rights, along with eight practical tips for employers examining their policies and procedures; 

  • The OPC has signed a renewed Memorandum of Understanding (MOU) intended to promote cross-border cooperation to combat unsolicited communications. Other MOUs signed by the OPC have been covered in volumes 16, 15, 13, and 9 of the Round-Up;

Ontario

  • A joint statement by the Information and Privacy Commissioner of Ontario (IPC) and the Ontario Human Rights Commission calls for the Ontario government to establish “clear and binding guardrails" around the public sector's use of AI technologies, taking into account the principles of safety, privacy, accountability, transparency, and human rights;

  • The Transparency Showcase, an interactive, online gallery featuring projects from municipal and provincial governments that demonstrating the benefits of transparency and open data, has been unveiled by the IPC;

British Columbia

  • Following the Liberal Party of Canada’s decision to cease using facial recognition technology for identification purposes in British Columbia nomination races, the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) announced that it has dropped its investigation into whether the party’s use of facial recognition technology complies with the Personal Information Protection Act;

  • A report detailing privacy challenges facing young people, and a plan to address these challenges through the proposed provincial Children’s Code, has been released by the OIPC BC.  The proposed Code would provide businesses with guidance on handling minors’ personal information;

  • In a speech to the province’s Select Standing Committee on Finance & Government Services, Information and Privacy Commissioner for BC Michael McEvoy discussed ongoing efforts towards provincial privacy law reform. Commissioner McEvoy’s speech also focused on the OIPC BC’s recent work, including investigations into facial recognition technology and legacy systems in place at healthcare organizations. Commissioner McEvoy made a separate appearance before the same committee in February of this year (details were provided in volume 21 of the Privacy Round-Up);

 

What's New with AccessPrivacy?

  • AccessPrivacy is hiring! We are looking for a Knowledge Management Lawyer, for an 18-month contract, to provide substantive support for the AccessPrivacy Knowledge Portal, assist with AccessPrivacy legislative reform initiatives, and collaborate with the AccessPrivacy team to plan high-quality events. Please see the position details on the Osler careers portal, and note that we are accepting applications on a rolling basis; 

  • We have added a practical "Notice and Transparency Checklist" to assist organizations in meeting certain key obligations under Law 25's amendments to the Quebec Privacy Act; 

  • We have added the French translation of our Key Obligations Chart, which thematically sets out organizations' obligations under Law 25's amendments to the Quebec Privacy Act. We are in the process of translating the balance of the "Key Resources" for Quebec in our Legislative Reform Portal;  

  • We have updated our Annotated Quebec Privacy Act, as amended by Law 25, to include references to the CAI Draft Guidelines on Criteria for Valid Consent; 

  • We are in the process of updating our Private Sector Topic Hubs, including cross-Canada statutory comparison charts, to incorporate Law 25 provisions coming into force in Quebec in September 2023. 

***

Sign up for AccessPrivacy's complimentary e-news updates to receive each edition of the Round-Up by email. The archive of past editions of the Privacy Round-Up is available to AccessPrivacy Knowledge Portal subscribers. 

Please note: if you are having issues opening links to publicly available materials, please try clearing your browser cache (including cookies and files) before clicking the link again.