TORONTO – The Privacy Commissioner of Canada wants the federal government to update the country’s outdated privacy laws to provide stronger enforcement powers to penalize companies that don’t properly protect consumers’ personal information.
During her keynote address to attendees at the 2013 Canada Privacy Symposium in Toronto today, commissioner Jennifer Stoddart released a position paper which offers a roadmap for modernizing Canada's federal private-sector privacy law so that it more effectively tackles current and future privacy issues.
Stoddart described the dramatically different privacy landscape that existed when the Personal Information Protection and Electronic Documents Act (PIPEDA) came into force back in 2001.
“There was no Facebook, no Twitter and no Google Street View. Phones weren’t smart. ‘The cloud’ was something that threatened picnic plans,” said Stoddart. “It is increasingly clear that the law is not up to the task of meeting the challenges of today –and certainly not those of tomorrow.”
“The purpose of our privacy law – to balance privacy and legitimate business needs – is no longer being met. The legislation lacks mechanisms strong enough to ensure organizations invest appropriately in privacy. As a result, consumer trust in the digital economy is at risk,” added Stoddart.
The position paper, called “The Case for Reforming the Personal Information Protection and Electronic Documents Act (PIPEDA),” outlines the following recommendations:
- Stronger enforcement powers that would grant the Privacy Commissioner with order-making powers and/or the ability to impose monetary penalties where circumstances warrant.
- Require organizations to report breaches of personal information to the Privacy Commissioner and to notify affected individuals, where warranted.
- Boost transparency by implementing public reporting requirements when law enforcement or government agencies obtain personal information without consent (which is currently allowed under PIPEDA)
- Promote accountability: Amend PIPEDA to introduce “enforceable agreements” to ensure organizations meet their commitments to improve their privacy practices following an investigation or audit.
