This certainly wasn’t the year we expected it to be.
In 2020, COVID-19 profoundly changed how we work and how we live our day-to-day lives. With science rapidly evolving, infection rates fluctuating, and advisories constantly changing, the pandemic has thrown us many curveballs this past year.
Difficult times like these can inspire change, and even growth, as we discover new ways to navigate the obstacles on our path.
For me, the last six months have been focused on learning, listening, meeting, and planning — putting down roots and settling into my role as commissioner.
I’ve been learning more about Ontario’s access and privacy laws and IPC’s processes, people, and culture. I owe tremendous gratitude to the IPC team, who welcomed me so warmly, helped ease my transition, and have shown great flexibility and unwavering commitment to continue serving Ontarians through a year like no other.
I’ve been meeting (virtually) with external stakeholders from various sectors, other officers of the Ontario legislature, and other Access and Privacy Commissioners across the country. Through these conversations, I’ve been broadening my horizons, getting to know new people, hearing diverse perspectives, and planting a few seeds for our future endeavours.
To that end, I have convened an advisory committee comprised of top experts in the data governance space to help guide our approach to selecting strategic priorities for the next five years. We are also seeking the views of all stakeholders through our public consultation process — open until January 22, 2021 — to identify those access and privacy issues that matter most to Ontarians.
All of this has been happening against a backdrop of unprecedented legislative change, particularly in the private sector.
Unlike Alberta, British Columbia, and Quebec, Ontario never adopted its own private sector privacy law. In Ontario, the activities of businesses are subject to a federal law called the Personal Information Protection and Electronic Documents Act (PIPEDA).
Enacted 20 years ago, PIPEDA has shown its age and has fallen out of pace with rapid advances in digital technologies and the more modern enforcement regimes of other jurisdictions.
Last August, just one month into my mandate, the Ontario government launched a public consultation process to explore whether the time has come for a made-in-Ontario private sector privacy law.
My office shared its views on what we see as the key ingredients of a made-in-Ontario private sector law, voicing support for an approach that enables important innovation to take hold in the province, while also respecting the privacy rights of Ontarians and empowering them to make meaningful choices.
Following the close of that consultation period, the federal government tabled the new Digital Charter Implementation Act, 2020 (Bill C-11) to modernize the federal private sector privacy regime, similar to what Europe and California have done, and to what Quebec is also proposing to do with its Bill 64.
It’s a significant reform, which if adopted, will certainly strengthen some aspects of consumer privacy protection for the benefit of all Canadians.
However, I remain hopeful that the Ontario government will continue to seriously explore whether Ontarians’ privacy rights would be better protected with a provincial privacy law that is substantially similar to the federal law, yet goes beyond the limits of Bill C-11 and aligns with local values, realities, and culture.
For example, a provincial private sector privacy law could provide more comprehensive protection in areas where the federal government is constitutionally constrained from acting, including employees of provincially-regulated companies, the activities of unions, political parties, charities, professional associations, and others in the not-for-profit sector.
An Ontario private sector privacy law could be better suited to the realities of small and medium sized enterprises (comprising 98% of all businesses in Ontario and representing 30% of the province’s gross domestic product), by designing a supportive regulatory framework and taking a more flexible and proportionate approach to education, advice, and enforcement.
An Ontario law could be better integrated with our province’s existing health sector and public sector privacy laws, to provide a more seamless regulatory regime for innovative, intersectoral initiatives specific to Ontario. Under the same jurisdiction, these laws could be carefully constructed so their provisions could more easily defer to (or prevail over) one another, and be governed by a single regulator.
A made in Ontario law could also fill an important void for vulnerable populations, including children, on which Bill C-11 is completely silent. Ontario has an important opportunity to address the unique aspects of consent, set out a clear regime for substitute decision-making, and provide additional levels of protections for those most vulnerable where warranted.
There are some who might worry that an Ontario law would only add to the constellation of statutes across the country, complicating the compliance burdens of companies engaged in interprovincial or international business.
If done properly, however, an Ontario law could, quite the contrary, be harmonized with the blueprint of Bill C-11 such that they complement, rather than duplicate one another and provincially-regulated businesses could be exempted from the federal regime. This approach of cooperative federalism has proven to work well in Quebec, BC, and Alberta, so why couldn’t it also work for Canada’s largest province?
As I write this blog, many astronomy enthusiasts are patiently waiting to see the “Great Conjunction” (otherwise known as the “Christmas Star”). They know how beautiful and exciting it can be when the two largest planets in the solar system, Jupiter and Saturn, line up almost perfectly to reveal a beautiful, bright splash in the night sky — a celestial phenomenon that last occurred in the year 1226.
So too can it be for us in the privacy world. By carefully lining up the federal law with a substantially similar Ontario law, we stand to witness a potentially brilliant convergence of ideas that reveal one of the most modern, agile, comprehensive, and protective privacy regimes in the world.
Hopefully, we won’t have to wait 800 years for that to happen, and when it does, it will be nothing short of spectacular!
My best wishes to you and yours for a happy, safe, and healthy holiday season, and may 2021 bring us all better and brighter days ahead.
Patricia
This post is also available in: French
