Bill C-11: An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make related and consequential amendments to other Acts

Tabled in the House of Commons, December 2, 2020

Explanatory Note

Section 4.2 of the Department of Justice Act requires the Minister of Justice to prepare a Charter Statement for every government bill to help inform public and Parliamentary debate on government bills. One of the Minister of Justice’s most important responsibilities is to examine legislation for inconsistency with the Canadian Charter of Rights and Freedoms [“the Charter”]. By tabling a Charter Statement, the Minister is sharing some of the key considerations that informed the review of a bill for inconsistency with the Charter. A Statement identifies Charter rights and freedoms that may potentially be engaged by a bill and provides a brief explanation of the nature of any engagement, in light of the measures being proposed.

A Charter Statement also identifies potential justifications for any limits a bill may impose on Charter rights and freedoms. Section 1 of the Charter provides that rights and freedoms may be subject to reasonable limits if those limits are prescribed by law and demonstrably justified in a free and democratic society. This means that Parliament may enact laws that limit Charter rights and freedoms. The Charter will be violated only where a limit is not demonstrably justifiable in a free and democratic society.

A Charter Statement is intended to provide legal information to the public and Parliament on a bill’s potential effects on rights and freedoms that are neither trivial nor too speculative. It is not intended to be a comprehensive overview of all conceivable Charter considerations. Additional considerations relevant to the constitutionality of a bill may also arise in the course of Parliamentary study and amendment of a bill. A Statement is not a legal opinion on the constitutionality of a bill.

Charter Considerations

The Minister of Justice has examined Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make related and consequential amendments to other Acts, for any inconsistency with the Charter pursuant to his obligation under section 4.1 of the Department of Justice Act. This review involved consideration of the objectives and features of the Bill.

What follows is a non-exhaustive discussion of the ways in which Bill C-11 potentially engages the rights and freedoms guaranteed by the Charter. It is presented to assist in informing the public and Parliamentary debate on the Bill.

Overview

Bill C-11, also known as the Digital Charter Implementation Act, 2020, would repeal parts of the Personal Information Protection and Electronic Documents Act and replace them with a new legislative regime governing the collection, use, and disclosure of personal information for commercial activity in Canada. As the core of this regime, the Consumer Privacy Protection Act would be enacted to maintain, modernize, and extend existing rules and to impose new rules on private sector organizations for the protection of personal information. The Consumer Privacy Protection Act would also continue and enhance the role of the Privacy Commissioner in overseeing organizations’ compliance with these measures. The Personal Information and Data Protection Tribunal Act would be enacted to create a Tribunal to hear appeals of orders issued by the Privacy Commissioner and apply a new administrative monetary penalty regime created under the Consumer Privacy Protection Act.  Provisions of the Personal Information Protection and Electronic Documents Act governing electronic alternatives to paper records would be retained under the new title of the Electronic Documents Act.

Government access to organizations’ information

The Consumer Privacy Protection Act would re-enact and add to the Privacy Commissioner’s existing investigation and audit powers and extend them to the Privacy Commissioner’s new authority to conduct inquiries into alleged violations of the Consumer Privacy Protection Act.  These powers include the authority to compel the production of records and enter private places, other than dwelling-houses, to examine records and converse with individuals in the place entered.  The Privacy Commissioner would be allowed to share information with certain other federal regulatory bodies if certain conditions are met. The Privacy Commissioner would keep the authority to share information with provincial counterparts and foreign states.

The Consumer Privacy Protection Act would also re-enact a range of provisions in the Personal Information Protection and Electronic Documents Act that allow organizations to disclose an individual’s personal information to a government institution without their knowledge or consent in certain circumstances. In addition, it would re-enact related provisions allowing an organization to collect personal information for the purposes of some of these disclosures.  Existing rules that may limit the information an organization is allowed to provide to an individual about these disclosures would remain.

Search and Seizure (section 8 of the Charter)

Section 8 of the Charter protects against unreasonable searches and seizures.  The purpose of section 8 is to protect individuals from an unreasonable intrusion into a reasonable expectation of privacy by the state.  A search or seizure will be reasonable if it is authorized by law, the law itself is reasonable (in the sense of striking an appropriate balance between privacy interests and the state interest being advanced), and the search is carried out in a reasonable manner. 

The following considerations support the consistency of the Privacy Commissioner’s investigative, inquiry, and audit powers with section 8.  Organizations will not necessarily enjoy a reasonable expectation of privacy in relation to information subject to these regulatory investigation, inquiry, and audit powers. Where they do, the Privacy Commissioner’s legal authority to access and share the information would be clearly set out in the Consumer Privacy Protection Act.  This legal authority would support the objectives of the Consumer Privacy Protection Act through tailored powers that would be similar to those found in other regulatory contexts and would be subject to restrictions governing their use. 

In the case of re-enacted provisions allowing organizations to disclose personal information to a government institution in certain circumstances, consistency with section 8 is supported by the following considerations.  The focus of the measures is on ensuring the Consumer Privacy Protection Act is not a barrier to disclosure where a disclosure is authorized by another source of legal authority, like another law, a warrant, or a subpoena, or where a disclosure is voluntary and at the initiative of a private sector organization. A broad range of transparency, accountability, and oversight provisions exist under other measures and the broader legal context governing public institutions to limit impacts on privacy interests. The limits on information that an organization is allowed to provide to an individual about disclosures to government institutions are tailored to allow information to be shared with the individual when it would not compromise sensitive government operations.

Similar considerations support consistency with section 8 in relation to provisions permitting the collection of personal information without an individual’s knowledge or consent for the purposes of specific disclosures to government institutions. These collection provisions enable organizations to respond to government requests for information where the disclosure to government is authorized by another source of legal authority, like another law, a warrant or a subpoena. They also support voluntary disclosures at the initiative of private sector organizations. These voluntary disclosures of personal information without the consent or knowledge of the individual are permitted only in limited situations. These include where the organization suspects the information relates to specifically listed matters of significant public importance, such as national security. 

Potential Limits on Commercial Expression and Openness in New Adjudicative processes

Restrictions on the collection, use, and disclosure of personal information in the Consumer Privacy Protection Act could impact regulated entities’ expressive activities where these activities would involve a collection, use, or disclosure of personal information that is restricted or prohibited under the Act. 

The Consumer Privacy Protection Act would also maintain the Privacy Commissioner’s general obligation of confidentiality with some exceptions, including an ability to make information public when the Commissioner considers that it is in the public interest to do so.  While the adjudicative functions of the Tribunal under the Personal Information and Data Protection Tribunal Act would be public by default, there are exceptions allowing for the protection of confidential information and holding proceedings in private.  In addition, unless the complainant consents, the Tribunal would be required not to disclose the complainant’s name or identifying information and would have discretion with respect to naming organizations in its decisions.

Freedom of Expression (section 2(b) of the Charter)

Section 2(b) of the Charter protects freedom of thought, belief, opinion and expression, including the open courts principle.  Under this principle, there is a presumption that court and tribunal proceedings are open to both the public and the media. Section 2(b) can also protect commercial expression. 

The following considerations support the consistency with the Charter of provisions that could limit the openness of adjudicative processes and the disclosure of related information.  Both the Privacy Commissioner and the Tribunal would retain discretion over the openness of their respective proceedings.  This discretion, which must be exercised in accordance with the Charter, allows a proper balance to be struck between openness and any competing considerations such as privacy.  There is a presumption that Tribunal proceedings will be open. 

To the extent the Consumer Privacy Protection Act would interfere with protected commercial expression, consistency with the Charter is supported by the following considerations. The Consumer Privacy Protection Act applies only to personal information and advances an important regulatory purpose.  It balances individuals’ interests in the protection of their personal information with organizations’ needs.  It is consent-based and recognizes a range of other circumstances in which personal information may be legitimately used for commercial purposes.  The provisions of the Consumer Privacy Protection Act may be viewed as proportionate to the objectives of supporting and promoting commerce through the protection of personal information. 

Enforcement regime

The Consumer Privacy Protection Act would authorize the Personal Information and Data Protection Tribunal to impose an administrative monetary penalty on an organization that has contravened the Act.  It would also create new offences for re-identifying personal information that has been de-identified, subject to an exception for security testing, and contravening an order issued by the Privacy Commissioner following an inquiry. The Consumer Privacy Protection Act would keep offences for when organizations knowingly contravene specific obligations they have under the Act.  The offence of obstructing the investigation of a complaint or the conduct of an audit would be extended to the Commissioner’s new inquiry function.  These offences would be punishable by fine.

Offence Rights (section 11 of the Charter)

Section 11 of the Charter guarantees certain rights to persons who have been charged with an offence, including the right to a fair and public hearing before an independent and impartial adjudicator.  Its protections apply only to persons “charged with an offence”.  For the purposes of section 11, this occurs when a person is subject either to proceedings that are criminal in nature, or that result in “true penal consequences”.  True penal consequences include imprisonment and fines with a punitive purpose or effect, such as when a fine or penalty is out of proportion to the amount required to achieve regulatory purposes.  The following considerations support the consistency of the administrative monetary penalty and offence provisions with section 11.

The proposed administrative monetary penalty provisions would not involve criminal charges, prosecution, or sentencing.  The Consumer Privacy Protection Act would expressly provide that their purpose is to promote compliance with the legislative regime, not punish.  Administrative monetary penalties would be subject to a legislated cap with no mandatory minimum fine.  The Personal Information and Data Protection Tribunal would have discretion to impose administrative monetary penalties.  The exercise of this discretion would be governed by statutory criteria.

While not punishable by imprisonment, the proposed offence provision would provide for criminal charges, prosecution, and sentencing that could engage rights under section 11 of the Charter.  In reviewing the relevant measures, no potential inconsistencies between the offence provisions and rights under section 11 have been identified.