Information and privacy commissioner urges Ontario to adopt its own private sector privacy law

Ontario should proceed with its own private sector privacy legislation regardless of whether Canada pursues law reform, the Office of the Information and Privacy Commissioner of Ontario said in response to the province’s white paper on proposals for this purpose.

The Personal Information Protection and Electronic Documents Act (PIPEDA), the federal private sector privacy law which also governs Ontario-based companies, is showing its age, said the commissioner. The statute’s supposed replacement, Bill C-11, or the Digital Charter Implementation Act, 2020, is also not moving forward, following the announcement of a September federal election.

“Privacy rights in Ontario could be better served and protected with a provincial private sector privacy law that provides enhanced privacy protections and better aligns with our province’s unique values, realities, and culture,” said Patricia Kosseim, information and privacy commissioner of Ontario, in a news release.

According to Kosseim, a provincial private sector privacy law may provide comprehensive protections beyond the reach of federal laws, may ensure expanded protection for those working for Ontario-regulated companies not under federal privacy legislation and may address the critical constitutional gaps for charitable organizations, unions, professional associations and political parties. It may also promote post-pandemic economic recovery and innovation.

For small and medium-sized businesses, expected pros include introducing an agile approach to regulation and compliance support, addressing issues relating to red tape and duplication of privacy laws and ensuring an exemption from PIPEDA’s applicability for businesses engaged in commercial activity in Ontario, said Kosseim. As for businesses conducting commercial activity across borders, the provincial law can focus on harmonization, which may facilitate interoperability between laws and enforcement cooperation between regulators, Kosseim added.

According to Kosseim, these benefits to small and medium-sized businesses are important because they are the “backbone of economic activity” with more than 440,000 employers, making up 86.4 per cent of the Ontario’s private sector workforce and 85.3 per cent of the provincial gross domestic product.

If Ontario does move forward with its own private sector privacy legislation, the commissioner plans to prioritize developing the building blocks and oversight mechanisms for implementing the law in a way that ensures the protection of privacy, promotes responsible innovation and reflects Ontario’s current situation.

“With its eyes and ears close to the ground, the IPC is well-equipped to support local organizations by providing practical guidance materials and impactful advisory services that reflect the day-to-day realities of doing business in our province,” Kosseim said.

Interested individuals may read the commissioner’s full submission here.