{"id":266287,"date":"2018-06-07T10:30:03","date_gmt":"2018-06-07T14:30:03","guid":{"rendered":"https:\/\/policyoptions.irpp.org\/issues\/enforcement-powers-key-pipeda-reform\/"},"modified":"2025-10-07T22:06:58","modified_gmt":"2025-10-08T02:06:58","slug":"enforcement-powers-key-pipeda-reform","status":"publish","type":"issues","link":"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/","title":{"rendered":"Enforcement powers key to PIPEDA reform"},"content":{"rendered":"

Canada\u2019s Personal Information Protection and Electronic Documents Act<\/em><\/a> (PIPEDA<\/em>) sets standards for the collection, use and disclosure of personal information by Canada\u2019s private sector. Unfortunately, it was designed for an economy in which personal information was a by-product of doing business, rather than a core commercial asset capable of limitless exploitation.<\/p>\n

In today\u2019s digital environment, businesses avidly harvest personal data. They do so in order to profile and track their customers: to predict their preferences, assess their creditworthiness, determine the price they are willing to pay and, in many cases, sell the data to third parties. So-called free apps and platforms proliferate; these rely upon the collection and monetization of vast amounts of personal information. In this data free-for-all, PIPEDA<\/em> mainly establishes fair information principles, combined with weak enforcement rules.<\/p>\n

Consent is the cornerstone of the Act, and consent to the collection of one\u2019s personal information is meant to be informed. A company\u2019s privacy policy is the means by which most consumers are given notice about what personal information is collected, for what purposes and with whom it is shared.<\/p>\n

But privacy policies today are long, complex and legalistic. When it comes to stating purposes, they are often vague. Reading a privacy policy before clicking \u201cI agree\u201d requires time and effort, and the reader might still not really understand what is going to happen to their personal information. Multiply this experience by the number of daily contacts we all have with companies that collect our personal information in physical and virtual environments. Then multiply it further by the constant collection of background data by our phones, our Internet service providers, our smart appliances and even our cars. It is not surprising that consent is broken. There is simply too much to manage, and often the way it is presented to consumers makes it difficult for them to make informed choices. In this context, clicking \u201cI agree\u201d without reading privacy policies is an act of surrender, not of consent.<\/p>\n

In 2015, PIPEDA<\/em> was amended to clarify that consent is valid only if it is reasonable to expect that an individual \u201cwould understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting.\u201d This appears to push the onus onto organizations to ensure they have communicated their practices effectively. Yet this has proven to be wishful thinking: the statute lacks the enforcement mechanisms that might make a real difference in encouraging meaningful legal compliance.<\/p>\n

Canada\u2019s privacy commissioners have addressed PIPEDA<\/em>\u2019s inadequacy on many occasions. The last commissioner, Jennifer Stoddart, pushed for significant amendments to the law, as has the current commissioner, Daniel Therrien. For the most part, they have been unsuccessful.<\/p>\n

Nevertheless, change may soon be on its way. The EU\u2019s new General Data Protection Regulation<\/em><\/a> (GDPR<\/em>) took effect in May 2018. Although Europe is an ocean away, this might be the kick needed to get Parliament to amend PIPEDA<\/em>. In fact, it was the GDPR<\/em>\u2019s predecessor, the EU Data Protection Directive<\/em><\/a>, that led to PIPEDA<\/em> in the first place. Now, because the EU insists that processing of its nationals\u2019 personal data outside the EU meet EU standards, it has been able to use the threat of cutting off data flows to noncompliant countries to motivate foreign governments to do something about protection of data in the private sector.<\/p>\n

As PIPEDA<\/em> barely met the standards set in the Data Protection Directive<\/em>, undoubtedly it falls below the GDPR<\/em>\u2019s new standards, which are tailored for the age of big data. If data are to continue to flow from Europe to Canada, Canada will have to do something about PIPEDA<\/em>, and soon. The House of Commons Standing Committee on Access to Information, Privacy and Ethics (ETHI) recently issued a report<\/a> on PIPEDA<\/em> that highlights many of its weaknesses and makes recommendations for reform. In drafting its report, ETHI clearly had the GDPR<\/em> in mind.<\/p>\n

When Parliament acts to amend PIPEDA<\/em>, how it deals with consent will be worth watching. In its recent report on consent<\/a>, part of the 2016-17 Annual Report to Parliament on the\u00a0<\/em>Personal Information Protection and Electronic Documents Act\u00a0and the<\/em>\u00a0Privacy Act<\/a>, <\/em>the Office of the Privacy Commissioner of Canada (OPC) supported keeping consent at the heart of PIPEDA<\/em>. At the same time, it made recommendations for improving the meaningfulness of consent.<\/p>\n

Interestingly, the majority of the OPC\u2019s recommendations are ones for which no legislative change is required. It is of the opinion that many improvements could be achieved through guidance that it will provide within the current legislative framework. Examples of this might be assisting organizations to provide more timely and meaningful information about their personal information practices; exploring technological mechanisms to enhance consent; providing guidance for obtaining consent from children and youth; and identifying \u201cno-go zones\u201d where the collection, use or disclosure of personal information is simply not acceptable.<\/p>\n

Where the OPC does recommend legislative change, it is predominantly in order to improve enforcement. This would include the ability to conduct compliance reviews and order-making powers for the commissioner, as well as the power to levy fines. It would also include a new private right of action for individuals. Currently, individuals can go to court only after filing a complaint and waiting over a year for the commissioner\u2019s nonbinding report of findings.<\/p>\n

Like the OPC, ETHI concludes that consent should remain at the core of PIPEDA<\/em>. It makes several recommendations to enhance consent, including making it the default rule that consumers must opt in to any collection, use or disclosure of their information, clarifying when and how consent can be revoked and specifically addressing consent for minors.<\/p>\n

Some of the committee\u2019s recommendations touch on but do not deal directly with consent. One is that the government consider \u201cthe collection, use and disclosure of depersonalized data\u2026, data that has been aggregated and presented in such a way that it is impossible to identify the owner\u201d as a way to protect privacy in the big data context. ETHI also recommends clarifying when already-collected personal information can be used for \u201clegitimate business interests\u201d without the need to seek fresh consent. These recommendations do not seem adequate in the current context, where consent seems to be badly broken, but perhaps ETHI is of the same mind as the OPC, that much can be achieved by the OPC\u2019s guidance strategies.<\/p>\n

Of some concern are ETHI\u2019s recommendations for new exceptions to consent requirements. These include a disturbing proposal to eliminate the need for consent to collection, use or disclosure of the vast troves of personal information found on social media sites.<\/p>\n

ETHI also calls for greater enforcement powers for the OPC. Both seem to be of the view that if the privacy commissioner had a bigger stick, businesses would take more care in complying with PIPEDA<\/em>\u2019s obligations. Certainly, in an environment where personal information is a hugely valuable commodity, it seems essential that there be serious enforcement measures to prevent a personal data free-for-all.<\/p>\n

As we head into a period of PIPEDA<\/em> reform, there is an urgent need to transform the soft, ombuds model of gently encouraged compliance into a model that gives real powers to the privacy commissioner to protect Canadians\u2019 privacy interests. It is the recommendations about enforcement, therefore, that are the most significant part of ETHI\u2019s and the OPC\u2019s work on consent and PIPEDA<\/em> reform. The modest recommendations for shoring up consent depend upon the commissioner having real powers to incentivize Canadian businesses to clean up their privacy acts. As the Cambridge Analytica\/Facebook scandal has made clear, the abuse of personal information for commercial gain not only harms individuals, it can also undermine broader social values. Privacy is not just a personal right but a public good.<\/p>\n

This article is part of the<\/strong>\u00a0Recalibrating Canada\u2019s Consumer Rights Regime<\/a><\/strong>\u00a0<\/strong>special feature.<\/strong><\/p>\n

Photo: Privacy Commissioner Daniel Therrien holds a news conference at the National Press Theatre in Ottawa, September 21, 2017. THE CANADIAN PRESS\/Sean Kilpatrick.<\/span><\/p>\n

\n

Do you have something to say about the article you just read? Be part of the\u00a0<\/em>Policy Options\u00a0discussion, and send in your own submission.\u00a0Here is a\u00a0<\/em>link<\/em><\/a>\u00a0on how to do it.\u00a0<\/em>|\u00a0Souhaitez-vous r\u00e9agir \u00e0 cet article ?\u00a0<\/em>Joignez-vous aux d\u00e9bats d\u2019<\/em>Options politiques\u00a0et soumettez-nous votre texte en suivant ces\u00a0<\/em>directives<\/em><\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Canada\u2019s Personal Information Protection and Electronic Documents Act (PIPEDA) sets standards for the collection, use and disclosure of personal information by Canada\u2019s private sector. Unfortunately, it was designed for an economy in which personal information was a by-product of doing business, rather than a core commercial asset capable of limitless exploitation. In today\u2019s digital environment, […]<\/p>\n","protected":false},"featured_media":257490,"template":"","meta":{"_acf_changed":false,"content-type":"","ep_exclude_from_search":false,"apple_news_api_created_at":"2025-10-08T02:07:00Z","apple_news_api_id":"e2210110-8336-4f8b-8fff-30d2b443486c","apple_news_api_modified_at":"2025-10-08T02:07:01Z","apple_news_api_revision":"AAAAAAAAAAD\/\/\/\/\/\/\/\/\/\/w==","apple_news_api_share_url":"https:\/\/apple.news\/A4iEBEIM2T4uP_zDStENIbA","apple_news_cover_media_provider":"image","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_cover_video_id":0,"apple_news_cover_video_url":"","apple_news_cover_embedwebvideo_url":"","apple_news_is_hidden":"","apple_news_is_paid":"","apple_news_is_preview":"","apple_news_is_sponsored":"","apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":[],"apple_news_suppress_video_url":false,"apple_news_use_image_component":false},"categories":[9385,9372,9383],"tags":[8543],"article-status":[],"irpp-category":[4337],"section":[],"irpp-tag":[7136],"class_list":["post-266287","issues","type-issues","status-publish","has-post-thumbnail","hentry","category-medias-et-culture","category-recent-stories-fr","category-sciences-et-technologies","tag-privacy-fr","irpp-category-science-et-technologie","irpp-tag-medias-et-culture"],"acf":[],"apple_news_notices":[],"yoast_head":"\nEnforcement powers key to PIPEDA reform<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Enforcement powers key to PIPEDA reform\" \/>\n<meta property=\"og:description\" content=\"Canada\u2019s Personal Information Protection and Electronic Documents Act (PIPEDA) sets standards for the collection, use and disclosure of personal information by Canada\u2019s private sector. Unfortunately, it was designed for an economy in which personal information was a by-product of doing business, rather than a core commercial asset capable of limitless exploitation. In today\u2019s digital environment, […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/\" \/>\n<meta property=\"og:site_name\" content=\"Policy Options\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/IRPP.org\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-08T02:06:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/policyoptions.irpp.org\/wp-content\/uploads\/2025\/08\/Scassa-2.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2000\" \/>\n\t<meta property=\"og:image:height\" content=\"700\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@irpp\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/\",\"url\":\"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/\",\"name\":\"Enforcement powers key to PIPEDA reform\",\"isPartOf\":{\"@id\":\"https:\/\/policyoptions.irpp.org\/fr\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/policyoptions.irpp.org\/wp-content\/uploads\/2025\/08\/Scassa-2.jpg\",\"datePublished\":\"2018-06-07T14:30:03+00:00\",\"dateModified\":\"2025-10-08T02:06:58+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/#primaryimage\",\"url\":\"https:\/\/policyoptions.irpp.org\/wp-content\/uploads\/2025\/08\/Scassa-2.jpg\",\"contentUrl\":\"https:\/\/policyoptions.irpp.org\/wp-content\/uploads\/2025\/08\/Scassa-2.jpg\",\"width\":2000,\"height\":700},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/policyoptions.irpp.org\/fr\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Enforcement powers key to PIPEDA reform\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/policyoptions.irpp.org\/fr\/#website\",\"url\":\"https:\/\/policyoptions.irpp.org\/fr\/\",\"name\":\"Policy Options\",\"description\":\"Institute for Research on Public Policy\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/policyoptions.irpp.org\/fr\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Enforcement powers key to PIPEDA reform","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/","og_locale":"fr_FR","og_type":"article","og_title":"Enforcement powers key to PIPEDA reform","og_description":"Canada\u2019s Personal Information Protection and Electronic Documents Act (PIPEDA) sets standards for the collection, use and disclosure of personal information by Canada\u2019s private sector. Unfortunately, it was designed for an economy in which personal information was a by-product of doing business, rather than a core commercial asset capable of limitless exploitation. In today\u2019s digital environment, […]","og_url":"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/","og_site_name":"Policy Options","article_publisher":"https:\/\/www.facebook.com\/IRPP.org","article_modified_time":"2025-10-08T02:06:58+00:00","og_image":[{"width":2000,"height":700,"url":"https:\/\/policyoptions.irpp.org\/wp-content\/uploads\/2025\/08\/Scassa-2.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_site":"@irpp","twitter_misc":{"Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/","url":"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/","name":"Enforcement powers key to PIPEDA reform","isPartOf":{"@id":"https:\/\/policyoptions.irpp.org\/fr\/#website"},"primaryImageOfPage":{"@id":"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/#primaryimage"},"image":{"@id":"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/#primaryimage"},"thumbnailUrl":"https:\/\/policyoptions.irpp.org\/wp-content\/uploads\/2025\/08\/Scassa-2.jpg","datePublished":"2018-06-07T14:30:03+00:00","dateModified":"2025-10-08T02:06:58+00:00","breadcrumb":{"@id":"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/#primaryimage","url":"https:\/\/policyoptions.irpp.org\/wp-content\/uploads\/2025\/08\/Scassa-2.jpg","contentUrl":"https:\/\/policyoptions.irpp.org\/wp-content\/uploads\/2025\/08\/Scassa-2.jpg","width":2000,"height":700},{"@type":"BreadcrumbList","@id":"https:\/\/policyoptions.irpp.org\/fr\/2018\/06\/enforcement-powers-key-pipeda-reform\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/policyoptions.irpp.org\/fr\/"},{"@type":"ListItem","position":2,"name":"Enforcement powers key to PIPEDA reform"}]},{"@type":"WebSite","@id":"https:\/\/policyoptions.irpp.org\/fr\/#website","url":"https:\/\/policyoptions.irpp.org\/fr\/","name":"Policy Options","description":"Institute for Research on Public Policy","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/policyoptions.irpp.org\/fr\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"}]}},"_links":{"self":[{"href":"https:\/\/policyoptions.irpp.org\/fr\/wp-json\/wp\/v2\/issues\/266287","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/policyoptions.irpp.org\/fr\/wp-json\/wp\/v2\/issues"}],"about":[{"href":"https:\/\/policyoptions.irpp.org\/fr\/wp-json\/wp\/v2\/types\/issues"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/policyoptions.irpp.org\/fr\/wp-json\/wp\/v2\/media\/257490"}],"wp:attachment":[{"href":"https:\/\/policyoptions.irpp.org\/fr\/wp-json\/wp\/v2\/media?parent=266287"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/policyoptions.irpp.org\/fr\/wp-json\/wp\/v2\/categories?post=266287"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/policyoptions.irpp.org\/fr\/wp-json\/wp\/v2\/tags?post=266287"},{"taxonomy":"article-status","embeddable":true,"href":"https:\/\/policyoptions.irpp.org\/fr\/wp-json\/wp\/v2\/article-status?post=266287"},{"taxonomy":"irpp-category","embeddable":true,"href":"https:\/\/policyoptions.irpp.org\/fr\/wp-json\/wp\/v2\/irpp-category?post=266287"},{"taxonomy":"section","embeddable":true,"href":"https:\/\/policyoptions.irpp.org\/fr\/wp-json\/wp\/v2\/section?post=266287"},{"taxonomy":"irpp-tag","embeddable":true,"href":"https:\/\/policyoptions.irpp.org\/fr\/wp-json\/wp\/v2\/irpp-tag?post=266287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}