Canada’s privacy legislation has been seemingly stalled. More recently, the Innovation Minister has blamed the opposition for the lack of movement.
Last November, we reported on Canada introducing a badly needed privacy reform bill. It’s badly needed because, up to that point, if a company suffered from a data leak or breach, the general recourse was, at most, a strongly worded letter from a Canadian privacy commissioner or two. No fines. No other real recourse. Just a single finger wagging because that alone will teach them.
Of course, things came to a head during the Cambridge Analytica scandal of 2018 where the company freely mined the data of peoples Facebook information. Many blame that for the ensuing Brexit and election of Donald Trump – two major political disasters that are continuing to see reverberations to this day.
So, the privacy commissioners did their usual actions: they wrote a strongly worded letter demanding Facebook change the way they do business. The response from Facebook was essentially, “bite me”. Then the question became, what are authorities going to do about it? They can’t sanction a company or issue fines because their position is, in fact, toothless. The only thing they could do was step out of their roles and sue Facebook as private citizens. Beyond that, there literally is nothing else that can be done, legally speaking.
Of course, the results of all of this is that Canada became a laughing stock to the world from a privacy perspective. The message is clear: if you, as a company, violate a users privacy, there are no real repercussions. Just ignore those pesky commissioners, wait a few days for the stock to recover, and you’ll be no worse for wear. After all, Canada is essentially lawless on this front.
The embarrassment of Canada only continued. In the US, the FTC fined Facebook $5 billion. Europe passed the GDPR which is a privacy law that continues to see dividends to this day. Other countries had no problem handing down fines against Facebook. Meanwhile, Canada? Well, at most, there’s people angry at Facebook, but there’s nothing anyone can really do about it.
As a result, Canada has well and truly become a laggard in the world when it comes to privacy. Gone are the days when Canada could be seen as a world leader in the realm of privacy. Boasting about how Canada has commissioners dedicated to personal privacy is now a laughably quaint thing these days. This especially considering the whole “strongly worded letter” thing as a repercussion for violating privacy laws.
So, when Bill C-11 (Consumer Privacy Protection Act) finally came about, it became a welcome sight for us. The bill was riding the momentum of a Liberal government who seemed to care about doing a good job for a change. Making Canada an innovative leader once again was actually something to strive for. By updating the privacy laws to allow for fines, Canada would finally fix a lot of the major holes found in our privacy laws.
After that? Nothing. Ever since that hopeful development, we’ve really seen nothing happening. In fact, we witnessed a major backsliding. Then Innovation Minister, Navdeep Bains, became more and more silent on these issues. It started becoming evident that he was the main reason why Canada had such a forward looking agenda for a while there. In October of last year, the Canadian government began ejecting its digital agenda which carried so much promise.
The backsliding worsened when the Canadian Heritage minister started pushing for the link tax law which is clearly the result of heavy lobbying from international corporations. The messaging gradually shifted from innovation being something to strive for to innovation is the enemy that should be defeated. The news went from bad to worse as Bains left his position, leaving Canada without a voice of reason on this file. Couple that with the ditching of accountability over Bill C-10 – the online content regulation bill and you have the complete transformation of a government now intent on being explicitly hostile towards the Internet and innovation.
It comes as no surprise that what progress has been made has been stalled. Questions began emerging on the status of the few positive developments the Canadian government had long ago. Michael Geist noted the lack of progress on Canada’s privacy legislation and described it as “misplaced priorities“:
The government’s decision to bury its own privacy bill is puzzling on several fronts. First, privacy is winning political issue. While the bill will face the usual hand-wringing from business, privacy has emerged as an important public concern and the government’s failure to address it – there are no marks for merely introducing a bill and doing nothing with it – could become a sore spot in an election campaign.
Second, if the federal government does not lead on the issue, others will step in. In Canada, that means provincial legislation such as that currently working through the Quebec legislature will quickly surpass the federal law as the leading model. Further the pressure from the European Union for Canada to upgrade its law to maintain its “adequacy status” is sure to increase, potentially leading to restrictions on data transfers between Canada and the EU in the absence of reforms.
Third, the government has instead chosen to prioritize Bill C-10, introduced only weeks before the privacy bill. Bill C-10, the Broadcasting Act reform bill, is facing criticism at committee since the bill creates enormous uncertainty, is constitutionally vulnerable, undermines Parliamentary oversight, and has been backed by claims from Canadian Heritage Minister Steven Guilbeault that even his own department is unable to support. While the witnesses that have long lobbied for reform provide the perfunctory support in their opening comments, some quickly revert to easily identifiable problems with the legislation that is somehow framed as saving Canadian broadcasting by eliminating Canadian ownership requirements and the prioritization of Canadian talent in productions. The bill will face years of litigation and do little to support Canadian film and television production until at least the latter half of the decade. Yet it was fast-tracked to committee without passing second reading and the subject of days of debate in the House of Commons.
There is a good chance that lobbying has something to do with all of this. The constant banging of the link tax drum and the abandonment of privacy laws does, indeed, make this a possible reason. Big publishing, such as News Corp, has been pushing hard to ensure that money made on the Internet gets diverted to them specifically. The large newspapers are also piling on because they want to be rewarded for their business failures in terms of adapting to the modern digital world. At the same time, how many large corporations want to go from no fines for breaching privacy rules to a nice large dollar amount for the same action? Not many. Why take on accountability when you don’t have to?
So, if one were to look at things from a political angle, you can find plausible answers as to why Canada has abandoned its innovation agenda in favor of being hostile towards the Internet.
It seems that the flack has caught the attention of the current innovation minister. François-Philippe Champagne commented on Twitter that the long delays in Canada’s privacy legislation is all the Conservative’s fault:
C-11 is a top priority for me as Minister & for our government as a whole. @erinotoole
& the @CPC_HQ are systematically obstructing the govt’s agenda, incl pandemic-related support for people and businesses, by playing legislative games.
The playing of the partisan card didn’t go unnoticed by Geist who responded:
Glad to see @FP_Champagne says C-11 is a top priority. Now how about allocating more than one day of debate in the House of Commons in 3 1/2 months and getting the bill into committee.
As noted, there could soon be increasing pressure from the European Union on top of it all. It would be understandable on a number of fronts. If businesses in Europe have to abide by modern privacy laws, then they deserve to have a level playing field when competing against companies operating in Canada who have, really, little to no accountability.
Additionally, if personal information is flowing from Europe to Canada, and a leak happens on Canada’s side, then it becomes difficult to enforce privacy laws. This can send one of two messages: One: don’t do business with anyone in Canada or two: If you can deflect blame to Canada, then you have effectively found a loophole within the law. No matter which way you look at it, it’s not a good look.
So, little surprise that many are saying that it’s only a matter of time before Europe starts demanding Canada finally get its act together on privacy laws.
This does raise another valid question: why would Canada need pressure from other counties to do the right thing and actually give privacy laws teeth in the first place? For all the ra ra from some politicians who still insist that Canada is an innovation and digital leader of the world, why should Canada need pressure from other countries (or, in this case, a whole continent) just to put in place the bare minimum? Safeguarding the personal privacy of citizens is really an entry level move here. All signs point to Canada not only lagging behind, but also expressing reluctance in moving into the starting gate. That’s the story Canada’s actions are telling at this stage.
Drew Wilson on Twitter: @icecube85 and Facebook.
