Digital Privacy Act

An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act

This bill was last introduced in the 41st Parliament, 2nd Session, which ended in August 2015.

Status

This bill has received Royal Assent and is now law.

Summary

This is from the published bill. The Library of Parliament often publishes better independent summaries.

This enactment amends the Personal Information Protection and Electronic Documents Act to, among other things,
(a) specify the elements of valid consent for the collection, use or disclosure of personal information;
(b) permit the disclosure of personal information without the knowledge or consent of an individual for the purposes of
(i) identifying an injured, ill or deceased individual and communicating with their next of kin,
(ii) preventing, detecting or suppressing fraud, or
(iii) protecting victims of financial abuse;
(c) permit organizations, for certain purposes, to collect, use and disclose, without the knowledge or consent of an individual, personal information
(i) contained in witness statements related to insurance claims, or
(ii) produced by the individual in the course of their employment, business or profession;
(d) permit organizations, for certain purposes, to use and disclose, without the knowledge or consent of an individual, personal information related to prospective or completed business transactions;
(e) permit federal works, undertakings and businesses to collect, use and disclose personal information, without the knowledge or consent of an individual, to establish, manage or terminate their employment relationships with the individual;
(f) require organizations to notify certain individuals and organizations of certain breaches of security safeguards that create a real risk of significant harm and to report them to the Privacy Commissioner;
(g) require organizations to keep and maintain a record of every breach of security safeguards involving personal information under their control;
(h) create offences in relation to the contravention of certain obligations respecting breaches of security safeguards;
(i) extend the period within which a complainant may apply to the Federal Court for a hearing on matters related to their complaint;
(j) provide that the Privacy Commissioner may, in certain circumstances, enter into a compliance agreement with an organization to ensure compliance with Part 1 of the Act; and
(k) modify the information that the Privacy Commissioner may make public if he or she considers that it is in the public interest to do so.

Elsewhere

All sorts of information on this bill is available at LEGISinfo, an excellent resource from the Library of Parliament. You can also read the full text of the bill.

Votes

June 18, 2015 Passed That the Bill be now read a third time and do pass.
June 18, 2015 Failed That the motion be amended by deleting all the words after the word “That” and substituting the following: “this House decline to give third reading to Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act, because it: ( a) threatens the privacy protections of Canadians by allowing for the voluntary disclosure of their personal information among organizations without the knowledge or consent of the individuals affected; ( b) fails to eliminate loopholes in privacy law that allow the backdoor sharing of personal information between Internet service providers and government agencies; ( c) fails to put in place a supervision mechanism to ensure that voluntary disclosures are made only in extreme circumstances; ( d) does not give the Privacy Commissioner of Canada adequate order-making powers to enforce compliance with privacy law; and ( e) proposes a mandatory data-breach reporting mechanism that will likely result in under-reporting of breaches.”.
June 2, 2015 Passed That Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act, as amended, be concurred in at report stage and read a second time.
June 2, 2015 Failed
June 2, 2015 Failed
May 28, 2015 Passed That, in relation to Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act, not more than one further sitting day shall be allotted to consideration at the report stage and second reading stage of the Bill and one sitting day shall be allotted to consideration at the third reading stage of the Bill; and That, 15 minutes before the expiry of the time provided for Government Orders on the day allotted to the consideration at the report stage and second reading stage of the said Bill and on the day allotted to consideration at the third reading stage of the said Bill, any proceedings before the House shall be interrupted, if required for the purpose of this Order, and, in turn, every question necessary for the disposal of the stage of the Bill then under consideration shall be put forthwith and successively, without further debate or amendment.

Opposition Motion—Safeguarding of Personal InformationBusiness of SupplyGovernment Orders

May 5th, 2014 / 12:10 p.m.
See context

NDP

Charlie Angus NDP Timmins—James Bay, ON

Mr. Speaker, I want to thank my hon. colleague. I have great respect for the excellent work she does for Canadians on this very important file.

I would like to ask her about the spin we are hearing from the government. Conservatives keep changing their story about how they actually somehow care for Canadians' private information, and the Minister of Industry is telling us that Bill C-13 and Bill S-4 will fix the problem. They will fix it, all right.

Under Bill C-13, anyone designated as a public officer will be able to gather information without a warrant. It is in the bill. Under clause 20, what a peace officer or public officer would be in the Criminal Code would include wardens, reeves of small towns, sheriffs, justices of the peace, and persons designated under the Fisheries Act, meaning that the Fisheries Act would be able to get information from the telecoms about folks in Timmins—James Bay who are out fishing. Of course, mayors are included as well.

It seems to me that the government is now moving backward to actually legalize widespread snooping and open up snooping to all manner of people who have no business being able to find out personal information, what people do on the Internet, or who they phone.

I would like to ask my hon. colleague why she thinks the government is telling Canadians that allowing widespread snooping by wardens, reeves, sheriffs, mayors, and people designated under the Fisheries Act will somehow protect Canadians' privacy.

Opposition Motion—Safeguarding of Personal InformationBusiness of SupplyGovernment Orders

May 5th, 2014 / noon
See context

NDP

Charmaine Borg NDP Terrebonne—Blainville, QC

moved:

That, in the opinion of the House, the government should follow the advice of the Privacy Commissioner and make public the number of warrantless disclosures made by telecommunications companies at the request of federal departments and agencies; and immediately close the loophole that has allowed the indiscriminate disclosure of the personal information of law-abiding Canadians without a warrant.

Mr. Speaker, I would like to begin by stating that I will be sharing my time with my colleague from Timmins—James Bay.

I am very pleased today to move this motion to ensure that justice is served for Canadians. However, I am very disappointed to have to rise once again to protest this government's extremely reprehensible actions.

I would have thought that, after three years, it would have finally understood. However, once again, the government has been caught spying on its own people.

With such ridiculous statements as, for example, if we did not support bill C-30 we were siding with pedophiles, the government has constantly tried to minimize the impact of its proposed measures on the lives of Canadians, all the while boasting and insinuating that it is proposing reasonable and necessary measures, which has been proven to be false by many impartial stakeholders.

The Conservative government called our assessment “speculation and unwarranted fearmongering” or a series of outlandish conspiracies made up by the NDP. After being harshly criticized by the public, media, and civil liberty and rights groups, as well as by privacy experts, the government finally listened and withdrew these bills or let them die on the order paper.

However, we still need to point out that exploiting the personal information on Canadians without reasonable cause and without a warrant is a huge violation of their privacy. I do not think I have heard about 1.2 million criminals being convicted of accessing personal information in 2011.

Last week, new revelations showed that government agencies and departments allegedly asked telecommunications companies to share personal information with them without a warrant. Not once, not a hundred times or a thousand times. They asked 1.2 million times.

We condemn this highly questionable tactic, since there is no legislative oversight to determine whether the government's reasons for accessing this information were valid.

Like many Canadians, I understand and support the need for security authorities to have the tools they need to fight crime in our country and to make us feel safe at home.

However, how can the government justify 1.2 million requests in a single year to achieve that goal? That happened in 2011, and the government was not required to explain what this information was necessary or how and for what it would be used.

When I think of the majority of Canadians who abide by the law and who could be affected by these requests, I find it unacceptable, disgusting and incomprehensible that the government is treating them like criminals.

The privacy of Canadians has been taken lightly by past Liberal and Conservative governments for far too long, and Canadians affected by the thousands of data breaches in government agencies are paying the price. To hear that the government is snooping on them as though they were common criminals when they have done nothing wrong is another blow on top of it all. Last week the government tried to make us believe these requests were made for public safety reasons, but let us look at the case of the CBSA.

In response to my order paper question, after reviewing the number of requests made from the CBSA in one year, we find that no requests were made in exigent circumstances. The 18,849 others were made in non-exigent circumstances. From these requests, only two were made for national security reasons, none for terrorism alerts, none for foreign intelligence, and none on the grounds of child exploitation, so it is hard to believe the government when it says that these millions of requests were made for national security reasons when the numbers speak a very different truth.

Canadians understand that law enforcement institutions need information to identify, catch and judge criminals. However, when the government makes 1.2 million requests for Canadians' private information from telecommunications companies per year, that is not just about cracking down own crime; that is spying.

The vast majority of Canadians are law-abiding. There is no reason for the government to engage in such broad spying activities. If the Canadian government decides to spy on its own citizens, it should do so only if it has reason to suspect them and only with a warrant.

If the law permits this kind of warrantless spying, the law must be changed immediately, and that is what the NDP is trying to do today. If the government needs a warrant to listen to Canadians' phone conversations, the same should apply to their online activities.

We understand that certain extremely urgent circumstances do not permit the obtaining of a warrant. However, the information we received from the Privacy Commissioner last week goes far beyond the imaginable: 1.2 million requests for subscriber data without a warrant is unacceptable and unjustifiable.

In Canada, we are very lucky to have a legal framework for obtaining a warrant. That framework protects Canadians and prevents abuses by the authorities. Unfortunately, there is a loophole in the system the Liberals introduced.

Today, the Conservatives are taking advantage of that loophole to spy on their own citizens. Clearly, the government is no longer in control of the warrantless disclosure procedures.

As I said earlier, the Conservatives' spying cannot be justified on national security grounds. Moreover, it is done in secret. The Privacy Commissioner is not even informed.

If the government had a real, viable motive for snooping on Canadians, it would have no problem whatsoever with warning Canadians when they were being snooped on, it would have no issue working with the OPC, and it would strengthen our laws to better protect Canadians against these types of abuses.

We do not know why, how often or how long the government has been spying. What is even more incredible is that the Conservatives have long been trying to expand the legal framework around requesting information without a warrant. If the government decides to spy on Canadians, there should be just cause, it should be overseen by the courts and it should happen only under exceptional circumstances.

What is even more ridiculous than the government's unwillingness to protect Canadians' privacy is its complete lack of understanding about the scope of the problem. Just last week, the Privy Council Office asked that all departments provide details about the number of personal information requests submitted to various telecommunications companies over the past three years.

That proves that the government has abused the loophole in the law to the point where it has lost control of its departments on this issue.

The Conservatives have proven that they are unable to protect the privacy of Canadians. The Privacy Act dates back to 1983, before the arrival of the Internet, and PIPEDA has not been updated since 2000, before the age of social media.

Instead of strengthening the laws and increasing government accountability, the Conservatives are moving in the other direction. Instead of protecting Canadians' privacy, Bills C-13 and S-4 will increase the likelihood that the government will spy on its own citizens. From an ethical standpoint, that is extremely problematic.

With Bill C-13 alone, the government would expand the number of people who can make requests for subscriber data so that even people like Rob Ford could access our personal information. It would create legal immunity for voluntary disclosure of personal information and it would expand the circumstances under which personal information could be disclosed.

As if that were not enough, the government is using taxpayers' money to spy on them. Government agencies pay telecommunications companies between $1 and $3 for each information request. That means that, at the very least, Canadian taxpayers have paid between $1.2 million and $3.6 million to be spied on. I say that is the minimum because only some of the telecommunications companies have disclosed how often they provide information to the government.

If all of those information requests were justified, and if the telecommunications companies were not worried about disclosing their practices, I would likely not be making this speech today. Unfortunately, the Conservatives are trying so hard to hide their spying that it is worrisome.

What are they using all that personal information for? Can they even justify the importance of the information? It is clear that the government believes that Canadians are criminals because it spies on them without their knowledge, as though it suspected them of something. This motion defends the privacy rights of law-abiding Canadians, and it is meant to counter the government's nefarious attempts to get information by the back door.

Since becoming the critic for digital issues, I have risen dozens of times to draw attention to and criticize the alarming state of our privacy laws. Laws that are meant to properly protect us in the digital age should have been revised years ago and are now unsuitable for protecting the public and our children.

In my time as opposition critic for digital issues, I have seen not one but four different pieces of legislation introduced in the House that would facilitate government snooping instead of fixing the problem.

Canadians are worried. They are right to be. The Internet that they have known as an open and free space for social and political discussions is threatened by the snooping of their very own government. Law-abiding citizens should be able to benefit from the Internet without the threat of being treated like common criminals.

I ask all my colleagues to vote in favour of our motion in order to restore Canadians' trust in matters concerning the protection of their privacy and of the Internet as the social and political tool it should be.

PrivacyOral Questions

May 2nd, 2014 / 11:40 a.m.
See context

Oak Ridges—Markham Ontario

Conservative

Paul Calandra ConservativeParliamentary Secretary to the Prime Minister and for Intergovernmental Affairs

Mr. Speaker, the hon. member knows quite clearly that Canadians' personal information that is protected by the charter requires a warrant. Moreover, the legislation that governs this, of course, was introduced by the Liberal Party, and we had not heard a word from the Liberals until a couple of days ago that there were any problems with it.

Having said that, we did recognize that some updates needed to happen. That is why we brought a bill forward, Bill S-4, which will address this even further. We have been consulting, and we have spoken to the Privacy Commissioner. I would suggest that the opposition support that bill.

PrivacyOral Questions

May 2nd, 2014 / 11:30 a.m.
See context

Oak Ridges—Markham Ontario

Conservative

Paul Calandra ConservativeParliamentary Secretary to the Prime Minister and for Intergovernmental Affairs

Mr. Speaker, it seems that the opposition is finally moving in the right direction. I know that yesterday, the Liberals said it was millions and millions of Canadians who were being spied on. Then it was 1.2 million to two million from the NDP. Now it is thousands. I am sure by next week, the truth will actually be talked about by the opposition. What we are doing here is that the telecoms are being asked, in instances of national security, in instances when violent crime is taking place, to assist our authorities. There is, of course, civilian oversight to make sure that this is all done properly.

Moreover, any personal information protected by the Charter requires a warrant. There is Bill S-4 in front of the Senate, which will help improve this even further.

PrivacyOral Questions

May 2nd, 2014 / 11:30 a.m.
See context

NDP

Mathieu Ravignat NDP Pontiac, QC

Mr. Speaker, he is referring to the famous Bill S-4, as though it will fix everything. I do not know if they have read their own bill, but I must say that it will not change a thing. As long as the government continues to use national security as an excuse to invade the privacy of hundreds of thousands of Canadians, this problem will continue.

When will the government propose measures to ensure that telecom companies disclose the information collected on Canadians? When?

PrivacyOral Questions

May 2nd, 2014 / 11:30 a.m.
See context

Oak Ridges—Markham Ontario

Conservative

Paul Calandra ConservativeParliamentary Secretary to the Prime Minister and for Intergovernmental Affairs

Mr. Speaker, the hon. member knows that that is not true. Moreover, as I was mentioning toward the end of my last answer, there is a bill being brought forward to look at tightening this up a little further. It is Bill S-4. The minister has been in contact with the Privacy Commissioner. She has suggested that the bill does advance Canadians' privacy further.

I would suggest that the opposition really take a hard look at what it is they are suggesting. Our security services do excellent work in making sure that our communities stay safe. It is time for the opposition members to get on board with them and trust that they are doing a good job. I know that we trust them to do that, and the results have been staggering. Great work.

PrivacyOral Questions

May 1st, 2014 / 2:45 p.m.
See context

Port Moody—Westwood—Port Coquitlam B.C.

Conservative

James Moore ConservativeMinister of Industry

Mr. Speaker, the NDP is coming very close to setting the indoor record for missing the point here.

The Personal Information Protection and Electronic Documents Act, section 7, spells out very clearly the parameters of this law. Beyond that, Bill S-4, our new legislation, the digital privacy act, further protects Canadians' privacy.

That is what the Privacy Commissioner said when she said that this bill contains “...some very positive developments for the privacy rights of Canadians”.

The NDP critic on this issue said, “We have been pushing for these measures and I'm happy to see them introduced”. That is the NDP position on our bill.

PrivacyOral Questions

May 1st, 2014 / 2:45 p.m.
See context

Port Moody—Westwood—Port Coquitlam B.C.

Conservative

James Moore ConservativeMinister of Industry

Mr. Speaker, that is not the case at all. We are talking about a piece of legislation from 2001. It was passed in the House of Commons in 1999 and implemented in 2001. There is nothing new about it.

With Bill S-4, we are implementing new measures to better protect the interests of individuals.

If this particular colleague of ours does not like this legislation, then I just have to wonder why she said, when we introduced the bill, “We have been pushing for these measures and I'm happy to see them introduced”.

That is what she herself said when we put the bill forward.

PrivacyOral Questions

May 1st, 2014 / 2:40 p.m.
See context

Port Moody—Westwood—Port Coquitlam B.C.

Conservative

James Moore ConservativeMinister of Industry

Mr. Speaker, it is an interesting approach to a parliamentary debate tactic to say that Canadians cannot trust the legislation that he in fact proposed for Canadians and that Canadians should not trust him because his legislation was so flawed.

We, of course, protect the privacy of Canadians. We are empowering the Privacy Commissioner with new tools to further protect Canadians online. Bill S-4, the digital privacy act, goes further than the Liberal Party ever endeavoured to go and further than the NDP has ever proposed to go in further protecting the privacy of Canadians online.

When the parliamentary committee considers this legislation, of course it can compel witnesses, and we are happy to hear what—

PrivacyOral Questions

May 1st, 2014 / 2:40 p.m.
See context

Port Moody—Westwood—Port Coquitlam B.C.

Conservative

James Moore ConservativeMinister of Industry

Mr. Speaker, if the member opposite does not believe in the Personal Information Protection and Electronic Documents Act, if he thinks it is inadequate, he was the solicitor general when the legislation was passed.

We have gone further forward to protect the privacy of Canadians. We are moving forward. Bill S-4 puts in place new protections for Canadians.

The Privacy Commissioner herself said about our legislation that she welcomes the proposals in this bill. She said this bill contains “very positive developments for the privacy rights of—”

PrivacyOral Questions

May 1st, 2014 / 2:40 p.m.
See context

Port Moody—Westwood—Port Coquitlam B.C.

Conservative

James Moore ConservativeMinister of Industry

Mr. Speaker, the committee can do what it wants and ask whomever it wants to appear as a witness before the committee.

However, our government introduced Bill S-4 to protect Canadians' private personal electronic information. That is why we introduced the bill, and here is what the Privacy Commissioner had to say about it:

I welcome [the] proposals [in this bill, which contains] some very positive developments for the privacy rights of Canadians....

That is what we are doing.

May 1st, 2014 / 12:50 p.m.
See context

Senior Assistant Deputy Minister, Senior Assistant Deputy Minister's Office, Department of Justice

Donald Piragoff

I believe Mr. Geist's comments are in relation to Bill S-4, and I cannot comment on Bill S-4. It's not my area of expertise nor the Department of Justice's expertise. That is a bill of the Minister of Industry.

May 1st, 2014 / 12:45 p.m.
See context

Donald Piragoff Senior Assistant Deputy Minister, Senior Assistant Deputy Minister's Office, Department of Justice

I can talk about Bill C-13. Bill S-4 is another bill, and it's not our bill. That's the bill for the Minister of Industry, I believe, so that's his responsibility. You'd have to ask other officials or other staff, Mr. Chairman, with respect to that bill.

In terms of the interplay, as the minister said, the Criminal Code provision enacted in 2004 was enacted for the purpose of clarifying that when Parliament enacted production orders in 2004, the enactment did not have a negative effect on the common law power of citizens to voluntarily provide information to the police, whether it be telcos or whether it be a person at the door. When the police come knocking at the door saying that there was a big ruckus across the street last night and asking if they saw anything, the person at the door has the choice of saying that they don't want to talk to them or saying, “Yes, I saw a lot and here's what I'm telling you.” That person would be protected. That's the common law power. It's in section 25 of the Criminal Code.

There was a concern about having a power to compel people to provide information: would this have a negative effect on the voluntary ability of people to provide information? So section 487.014 was created at the time, for greater certainty. As it says, “for greater certainty”, the fact that there is a production order does not affect the ability of people to voluntarily provide information, and that provision also said that people who provide voluntary information get the benefit of section 25 of the Criminal Code. Section 25 of the Criminal Code is the provision that says if you do something that you are authorized by law to do, you are protected from civil or criminal liability.

What the new amendment does is update the existing section 487 provision to do two things. One, because there are other types of tools that have been created by the bill, such as preservation orders, if a company voluntarily preserves data, this makes it clear that not only in providing the data but also in preserving the data voluntarily, one would be protected from civil or criminal liability.

The current situation right now with many of the telcos, for example—you wanted to know the relationship, Mr. Casey—is that there is no ability to compel a telco or an ISP to preserve information. The authorities have voluntary cooperation from some telcos and some ISPs, but not all. Nevertheless, we do have some who do voluntarily cooperate with the police and will voluntarily preserve data while waiting for the police to come back with a search warrant or a production order.

This would, then, extend the immunity provisions to also include those individuals who voluntarily preserve data, to ensure they are not liable civilly or criminally because they voluntarily cooperated with the police. That's the relationship between the two, Mr. Casey.

In terms of what the authority is, as to when telcos or other companies are authorized or compelled to provide information, one would have to look at PIPEDA, and again, that's not in my purview of expertise.

May 1st, 2014 / 12:45 p.m.
See context

Liberal

Sean Casey Liberal Charlottetown, PE

Thank you, Mr. Chair.

The minister seemed quite reticent to talk about the interplay between Bill C-13 and Bill S-4. Am I okay to ask about that? Are the witnesses comfortable talk about that?

May 1st, 2014 / 12:15 p.m.
See context

Conservative

Peter MacKay Conservative Central Nova, NS

I'm not here to discuss Bill S-4. Even if I were, we don't have that legislation in front of us here. So I'm not going to get into the provisions of a bill that we're not here to discuss.