protection regimes. Provincial commissioners also oversee provincial private sector
data protection laws in the three provinces that have enacted such legislation.
Each data protection statute in Canada provides a complaints mechanism for
those who feel that a public sector body, health information custodian, or private
sector organization has breached its obligations. Typically the complaints process
involves an investigation stage, and commissioners have broad powers to investigate. It is possible for complaints to be resolved between the parties through
mediation, but if resolution is not achieved, complaints may proceed to a hearing.
Some provincial commissioners have order-making powers under their enabling
legislation which means that a hearing in which a complaint is considered wellfounded can lead to a binding order. This is the case in B.C., Alberta and Quebec,
where the respective commissioners may make orders that are enforceable at law.
24
The federal Privacy Commissioner, who oversees both the federal public sector’s
Privacy Act and PIPEDA, has no order making powers and can merely make
recommendations regarding compliance.
25 Guidance in combination with audits,
investigations and recommendations are all used to achieve soft compliance with
legal obligations. The lack of order-making powers has been the subject of considerable criticism, and has led to calls for reform from many, including the former and
current privacy commissioners.
26 Those commissioners who do have order-making
powers do not have the power to award damages. Their orders are subject to judicial
review by the courts.
1.4 Self-Regulation
Canada’s federal private sector data protection law, PIPEDA, was built around the
Canadian Standards Association Model Code for the Protection of Personal Information. This is reproduced in Schedule I of PIPEDA, and provides much of the
normative core of the statute. PIPEDA does not preclude the adoption of sectoral
codes of practice that can guide organizations within particular sectors in complying
with data protection obligations. In fact, in the 2017-2018 Departmental Plan
27 for
the Office of the Privacy Commissioner of Canada, Commissioner Therrien indicated that his office supported the development of sectoral codes.
24 PIPA (B.C.), ss. 52–53; PIPA (Alberta), ss. 52–54; PPIPS, ss. 55 and 56.
25 PIPEDA, s. 13.
26 See, e.g. Privacy Commissioner of Canada (2017) Real fears, real solutions, p. 4; Privacy
Commissioner of Canada (2013b) The Case for Reforming.
27 Privacy Commissioner of Canada (2018a) 2017-18 Departmental Plan.
Data Protection and the Internet: Canada
59
data protection laws in the three provinces that have enacted such legislation.
Each data protection statute in Canada provides a complaints mechanism for
those who feel that a public sector body, health information custodian, or private
sector organization has breached its obligations. Typically the complaints process
involves an investigation stage, and commissioners have broad powers to investigate. It is possible for complaints to be resolved between the parties through
mediation, but if resolution is not achieved, complaints may proceed to a hearing.
Some provincial commissioners have order-making powers under their enabling
legislation which means that a hearing in which a complaint is considered wellfounded can lead to a binding order. This is the case in B.C., Alberta and Quebec,
where the respective commissioners may make orders that are enforceable at law.
24
The federal Privacy Commissioner, who oversees both the federal public sector’s
Privacy Act and PIPEDA, has no order making powers and can merely make
recommendations regarding compliance.
25 Guidance in combination with audits,
investigations and recommendations are all used to achieve soft compliance with
legal obligations. The lack of order-making powers has been the subject of considerable criticism, and has led to calls for reform from many, including the former and
current privacy commissioners.
26 Those commissioners who do have order-making
powers do not have the power to award damages. Their orders are subject to judicial
review by the courts.
1.4 Self-Regulation
Canada’s federal private sector data protection law, PIPEDA, was built around the
Canadian Standards Association Model Code for the Protection of Personal Information. This is reproduced in Schedule I of PIPEDA, and provides much of the
normative core of the statute. PIPEDA does not preclude the adoption of sectoral
codes of practice that can guide organizations within particular sectors in complying
with data protection obligations. In fact, in the 2017-2018 Departmental Plan
27 for
the Office of the Privacy Commissioner of Canada, Commissioner Therrien indicated that his office supported the development of sectoral codes.
24 PIPA (B.C.), ss. 52–53; PIPA (Alberta), ss. 52–54; PPIPS, ss. 55 and 56.
25 PIPEDA, s. 13.
26 See, e.g. Privacy Commissioner of Canada (2017) Real fears, real solutions, p. 4; Privacy
Commissioner of Canada (2013b) The Case for Reforming.
27 Privacy Commissioner of Canada (2018a) 2017-18 Departmental Plan.
Data Protection and the Internet: Canada
59