Charter of Rights and Freedoms.
107 Bill C-59 would provide additional safeguards
with a new system requiring pre-authorization for bulk data collection. However,
C-59 will permit the collection of “publicly available” information without authorization, and critics have suggested that the definition of “publicly available” is overly
broad.
108 The definition reads:
“publicly available information” means information that has been published or broadcast for
public consumption, is accessible to the public on the global information infrastructure or
otherwise or is available to the public on request, by subscription or by purchase. It does not
include information in respect of which a Canadian or a person in Canada has a reasonable
expectation of privacy.
109
Not only is the definition exceptionally broad, its boundaries are blurred by the
fact that it excludes information in relation to which there is a “reasonable expectation of privacy”. The existence or reasonableness of an expectation of privacy is
often a matter of debate.
Specific criminal activities that may have international and/or organized crime
dimensions are governed by the Proceeds of Crime (Money Laundering) and
Terrorist Financing Act.
110 This statute provides for some information sharing by
financial services providers with law enforcement and national security officials.
6 Remedies and Sanctions
PIPEDA’s enforcement is largely based upon a soft-compliance ombuds model. For
example, the Commissioner has the power to audit the personal information handling practices of an organization if he has reasonable grounds to believe that the
organization is not complying with its obligations under PIPEDA. An audit results in
a report of findings and recommendations that may be included in the Commissioner’s annual report to Parliament.
111
A person who feels their rights have been breached under PIPEDA can file a
complaint with the Privacy Commissioner of Canada.
112 The complaint may lead to
an investigation and ultimately to the issuing of a non-binding report by the Privacy
Commissioner.
113 If the complaint is considered well-founded, the report will also
include recommendations for changes to the organization’s practices. Once a report
has been issued, a complainant may file an application with the Federal Court of
107 Austin (2015), p. 107; Forcese (2015).
108 Forcese (2018), p. 8.
109 Bill C-59, An Act respecting national security matters, 41
st Parl., 1
st Sess., Part 3, Communications Security Establishment, s. 2.
110 SC 2000, c 17.
111 PIPEDA s. 19.
112 PIPEDA, s. 11.
113 PIPEDA, ss. 12, 13.
Data Protection and the Internet: Canada
71
107 Bill C-59 would provide additional safeguards
with a new system requiring pre-authorization for bulk data collection. However,
C-59 will permit the collection of “publicly available” information without authorization, and critics have suggested that the definition of “publicly available” is overly
broad.
108 The definition reads:
“publicly available information” means information that has been published or broadcast for
public consumption, is accessible to the public on the global information infrastructure or
otherwise or is available to the public on request, by subscription or by purchase. It does not
include information in respect of which a Canadian or a person in Canada has a reasonable
expectation of privacy.
109
Not only is the definition exceptionally broad, its boundaries are blurred by the
fact that it excludes information in relation to which there is a “reasonable expectation of privacy”. The existence or reasonableness of an expectation of privacy is
often a matter of debate.
Specific criminal activities that may have international and/or organized crime
dimensions are governed by the Proceeds of Crime (Money Laundering) and
Terrorist Financing Act.
110 This statute provides for some information sharing by
financial services providers with law enforcement and national security officials.
6 Remedies and Sanctions
PIPEDA’s enforcement is largely based upon a soft-compliance ombuds model. For
example, the Commissioner has the power to audit the personal information handling practices of an organization if he has reasonable grounds to believe that the
organization is not complying with its obligations under PIPEDA. An audit results in
a report of findings and recommendations that may be included in the Commissioner’s annual report to Parliament.
111
A person who feels their rights have been breached under PIPEDA can file a
complaint with the Privacy Commissioner of Canada.
112 The complaint may lead to
an investigation and ultimately to the issuing of a non-binding report by the Privacy
Commissioner.
113 If the complaint is considered well-founded, the report will also
include recommendations for changes to the organization’s practices. Once a report
has been issued, a complainant may file an application with the Federal Court of
107 Austin (2015), p. 107; Forcese (2015).
108 Forcese (2018), p. 8.
109 Bill C-59, An Act respecting national security matters, 41
st Parl., 1
st Sess., Part 3, Communications Security Establishment, s. 2.
110 SC 2000, c 17.
111 PIPEDA s. 19.
112 PIPEDA, s. 11.
113 PIPEDA, ss. 12, 13.
Data Protection and the Internet: Canada
71