European Commission Finds Canada's PIPEDA Adequate for GDPR Requirements
Canada's federal commercial privacy laws currently "maintain sufficient data protection levels for personal data transferred from the [European Union]," according to the European Commission (the "Commission"). A January 15, 2024 report (the "Report") from the Commission to the European Parliament and European Council presents findings from its first review of adequacy decisions made under Directive 95/46/EC, enacted in 1995, and later continued by the General Data Protection Regulations (the "GDPR), which entered into force in 2018. These adequacy decisions ensure that privacy laws in 11 countries, including Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA), are sufficient to facilitate data flows from the EU without additional requirements. The review, initiated as part of a broader GDPR evaluation, considers ongoing developments in data protection, necessitating periodic reassessment every four years. Charities and not-for-profits that process personal information from residents of the EU would be required to comply with the GDPR, even though PIPEDA may not directly apply to them.
In this Report, the Commission states the initial assessment reveals that the data protection framework in Canada has "converged with the framework of the EU." The Commission acknowledges the advancements within Canada's legal framework since the adequacy decision adoption, citing legislative amendments, case law, and oversight bodies' activities, all contributing to enhanced data protection. Particularly, the Report notes a strengthening of PIPEDA through various amendments and clarifications of key data protection requirements. The Commission suggests incorporating these developments into legislation to ensure legal certainty and consolidate requirements. Ongoing legislative reforms of PIPEDA offer an opportunity for such codification, according to the Report, potentially fortifying Canada's privacy framework. In terms of government access to personal data, Canada maintains clear and accessible rules under its constitutional framework, legislation, and data protection rules, with effective oversight and redress mechanisms in place, the Report states. The Commission concludes that Canada continues to ensure an adequate level of data protection, with ongoing legislative reforms poised to further strengthen privacy protections. Although not referred to directly by the Report, federal Bill C-27, currently in Second Reading in the House of Commons, would enact the Consumer Privacy Protection Act and replace PIPEDA with significant reforms to the federal privacy law regime as discussed in our June 2022 Charity & NFP Law Update.
New Bill C-63 Would Require Social Media Operators to Submit Safety Plans
On February 26, 2024, the federal government introduced Bill C-63, the Online Harms Act (the "Act"), designed to reduce the harms caused by harmful online content and ensure that social media operators are accountable and transparent regarding new duties that would be enacted. Among other things, Bill C-63 would establish a number of offices, including the Digital Safety Commission of Canada, whose mandate would be to administer and enforce the Act; the Digital Safety Ombudsperson of Canada, whose mandate would be to provide support to users of social media services; and the Digital Safety Office of Canada, whose mandate would be to support the Digital Safety Commission of Canada and the Digital Safety Ombudsperson of Canada in the fulfillment of their mandates. Bill C-63 would also impose a duty on social media operators to act responsibly by, among other things, submitting digital safety plans to the Digital Safety Commission of Canada, protect children by integrating prescribed design features into their services, making certain content inaccessible in certain circumstances and keeping records to demonstrate their compliance with the Act. Among other things, Bill C-63 also amends the Canadian Human Rights Act to make it a discriminatory practice to communicate or permit the communication of hate speech online and amends the Criminal Code to make committing an offence under the Act a hate crime, creating a new definition of "hatred" and increasing the maximum sentences for hate propaganda offences. The Act follows hard on the heels of the B.C. Intimate Images Protection Act and Regulation, which came into force on January 29, 2024 and creates new civil remedies for complainants whose intimate images have been published or shared without their consent.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
