Canada’s current legislative framework strikes the appropriate balance between protecting personal information and the requirements of commerce, two CBA sections told Privacy Commissioner Daniel Therrien in a letter.
The Privacy and Access Law Section and the CCCA were responding to a May 2016 discussion paper released by the Privacy Commissioner on the viability of the consent model used to collect personal information, and finding ways to improve individual control over personal information collected by businesses.
PIPEDA, Canada’s privacy law governing how the private sector collects, uses and discloses personal information in commercial business, has stood the test of time and kept up with developments in data-driven innovation, “all of which require the ongoing balance of the right to privacy with the need for organizations to collect, use and disclose (personal information) for reasonable purposes,” say the Section Chairs. “Our laws have been sufficient to address emerging online business models that increasingly rely on the collection of (personal information).”
Moreover, they argue, privacy is not an inviolable right, rather it is a right read into section 7 of the Charter of Rights and Freedoms “and must be balanced against competing concerns, including law enforcement, national security, third-party individual rights and legitimate business purposes.”
The consent-based model in PIPEDA “demands a reasonable purpose, except in narrowly defined circumstances,” for collecting individuals’ personal information, and means that businesses cannot force individuals to consent to the use of their personal information beyond that reasonable purpose.
The Sections note that while their members believe the consent model to be “flexible and robust,” others would like to see new exemptions for business, and an expanded definition of “publicly available” to reflect the changing times. They warn that any changes to the model carry the potential for unintended consequences, which must be considered.
In conclusion, the CBA Sections remain of the view that PIPEDA’s flexible consent model is working well, that existing enforcement provisions are sufficient when buttressed by other remedies in Canada’s legal framework, and a collaborative, cooperative approach through consultation and discussion with industry will help promote the objectives of PIPEDA and help businesses adapt to technology innovation without hampering advancement.