Groundhog Day for Canadian Privacy Legislation? 

November 30, 2023

Look for a year-end parlimentary break update to this article in the upcoming iG Journal.

Unless you live in Vancouver or Victoria, Groundhog Day in Canada is a misleading concept: regardless of whether the groundhog sees its shadow on February 2, you are safe to assume six more weeks of winter. 

However, for those who follow the never-ending effort to update Canada’s private sector privacy law, it is starting to feel like the movie Groundhog Day, where time and again stakeholders see the process repeat itself: a bill is introduced, it languishes on the Parliamentary agenda, an election is called, the bill dies, and the process starts over. 

With growing speculation of a federal election in 2024, this could happen again, meaning further delays in updating Canada’s privacy framework – a process that began in 2017. 

Whither Bill C-27? 

The Federal Government introduced Bill C-27 on June 17, 2022.  This bill replaces Canada’s existing private sector privacy legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA), with a new framework.  It is the most significant overhaul of the law since its introduction in 2000. 

Bill C-27 contains three acts.  The first establishes the Consumer Privacy Protection Act and includes making privacy a fundamental right; requiring organizations have a privacy management program; mandating that organizations dispose of information once no longer necessary; and codifying a breach notification provision, amongst many other items.  

The second creates the Personal Information and Data Protection Tribunal Act, which will be a new body to facilitate enforcement of the above.   

The third is the Artificial Intelligence and Data Act, which contains new rules for development and deployment of artificial intelligence systems. 

Bill C-27 also gives the Privacy Commissioner order-making powers and lays out a framework for fines – up to 5% of global revenue or $25 million, whichever is greatest, for serious offences.  The Privacy Commissioner can recommend fines, while the Tribunal would ultimately decide on them. 

The Bill’s legislative path has not been a speedy one.  After being introduced on June 17, 2022, it did not begin Second Reading debate until November 2022, and it did not pass that stage until April 2023, when it was referred to the House of Commons Industry Committee.  Hearings at the latter did not begin until September, though have occurred regularly through the fall.   

However, the Minister responsible has presented significant amendments, which will take time to review.  As a result, it is unlikely the Bill will get out of Committee and through Third Reading in the House before Christmas.  And once through the House, the Bill must pass these same legislative stages in the Senate.  

If there is a spring election, there is a very good chance Bill C-27 will not pass beforehand.   

Déjà-vu All Over Again?      

If this happens, it will be history repeating itself.  A previous version of this Bill (C-11) was introduced in the House on November 17, 2020.  That Bill never concluded Second Reading and was killed when an election was called on August 15, 2021. 

Bill C-11 had stemmed from a Parliamentary Committee review of PIPEDA that began in February 2017 and concluded a year later.  It was in May 2019 that the Government announced its plans to act on that review with amendments to PIPEDA – the ones that came over a year later in Bill C-11. 

In effect, therefore, the timeline from the Committee review that led to C-11 to where Parliament sits today with Bill C-27 has already taken over six years.  If C-27 is not passed before February 2024, it will be seven years.  And if an election interrupts the process again, there will be further delays. 

What Next? 

There is some good news for those hoping the law will finally be updated: all parties in the House seem to agree that the privacy portions of Bill C-27 should be passed expeditiously (to the degree anything in Parliament is expeditious).   

The challenge will be getting agreement on a final text when the witnesses have ranged from those who suggest Bill C-27 is solid legislation that can be improved with a few amendments, to those who claim it is an abomination and should be scrapped and the process start over.  The former is much more likely, but if and when it gets through the House, a similarly protracted review is likely in the Senate.  Witnesses appearing before Committee have asked for 2-3 years for implementation.   

i-SIGMA has already filed a written submission to the House Industry Committee on the Bill and will do so again in the Senate.  Ideally, this will help inform a strengthened law that will be passed some time in 2024.   

Bill C-27 is inching closer to the finish line, but beware of groundhogs coming in the form of elections. 

Duncan Rayner is Vice President of Temple Scott Associates, a government relations and public affairs firm based in Ottawa and Toronto.