Current Policy + Legislation
There are a number of legislations and policies in Canada that govern the collection and use of data. However, there has been increasing recognition that some of these documents need to be updated to reflect the current environment. Additionally, Canadians’ ever-changing definitions of what is considered public and private information contribute to the blurry line of privacy in the era of big data. A number of modernization efforts are underway to reform current policy and legislation surrounding personal data collection.
One of the recent changes made by the Ontario Ministry of Health was intended to modernize Ontario’s Personal Health Information Protection Act (PHIPA) to enable patients to access their personal health information more easily, and to make patient health data more broadly available to health-care practitioners, researchers, and innovators as a way to stimulate economic development. These changes have faced criticism from privacy experts, who argue that there is a lack of protections to ensure an individual’s health data is safeguarded. This includes proper measures to anonymize patient data and ensure it does not fall into the wrong hands, such as those of marketers or insurers.
The Personal Information Protection and Electronic Documents Act (PIPEDA) has come under criticism for the lack of relevance of its consent regime and enforcement model in the digital, data-driven economy. “The House Standing Committee on Access to Information, Privacy, and Ethics has also recommended updates to improve control and organizational transparency, in order to strengthen privacy protections in an age where individuals feel a lack of control and understanding.”
At the national level, the Government of Canada has made it a priority to advance Canada’s Digital Charter. A 2019 mandate letter from Prime Minister Justin Trudeau sets out 25 priority areas, including data privacy, and calls upon the Privacy Commissioner to establish a set of online rights. This includes, but is not limited to, the right to erase, withdraw, or remove your personal data; the right to know how your data is used; the ability to withdraw consent to the sale or sharing of personal data; and the right to view and challenge the amount of personal data collected by a company or government entity.
As part of the Data Strategy Road Map, the federal government has acknowledged that it needs to change how it collects, manages, governs, and shares data across sectors, across governments, and with Canadians. Among six recommendations is a call to “[i]mprove and develop overall standards and guidelines that govern how departments access, collect, use, safeguard, and share data, and a clear process for developing and refining these over time”; and to “[c]larify the governance around data to ensure that the Government of Canada manages valuable data assets for the public good.” In June 2019, the federal government announced it had completed major improvements to the Access to Information Act. This included giving the Information Commissioner the ability to make binding orders to government institutions to release information, and ensures relevant government institutions operate by the principle of “open by default” in order to make key information available to individuals without the need to request it. The Access to Information Act undergoes revisions every 5 years. Revisions have yet to address frustrations related to the length of time it takes to receive information once it has been requested, and do not address current exemptions in the law that allow government agencies to withhold or redact information if it pertains to “national security, legal privilege, and business dealings.”
Some efforts to modernize provincial legislation related to personal data are also underway. For example, Ontario’s Digital Strategy consultations, launched in February 2019, seek to gain insight from residents and business owners to inform the strategy’s core principles. The Government of British Columbia also launched Draft Principles for Digital Change for feedback in January 2020, with one of its pillars focused on the management of information and data in accordance with value and user needs.