Bill C-27: The impact of proposed changes on the provincial (Alberta) privacy legislation

Bill C-27 (An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts) has passed its first reading in the House of Commons on June 16, 2022 and is currently at its second reading.

If passed into law, Bill C-27 will bring sweeping changes to the Canadian private sector privacy law landscape, to modernize it for the digital age. The changes may also lead to a loss of the exemption status currently extended to some provinces that have enacted their own private sector privacy laws similar to the Personal Information Protection and Electronic Document Act (PIPEDA), unless these provinces update their laws to align with the anticipated changes in the relevant parts of Bill C-27. This article will highlight some of the steps taken by the Alberta Legislature to comply with these changes.

Bill C-27 will result in the enactment of three new statutes:

1. The Consumer Privacy Protection Act (CPPA), which will repeal and replace parts of the PIPEDA to reflect current technological changes in the processing of private sector personal information.
2. The Personal Information and Data Protection Tribunal Act (PIDPTA), which will establish the Personal Information and Data Protection Tribunal.
3. The Artificial Intelligence and Data Act (AIDA), a novel piece of legislation that will establish rules around the responsible deployment of Artificial Intelligence (AI) technologies, including establishing an AI and Data Commissioner, to be responsible for assessing and mitigating the risks of harm and bias, and outlining criminal offences and penalties relating to the use of AI technologies.[1]

Relationship with the Provincial Private Sector Privacy Laws

PIPEDA was enacted in 2001, to apply to organizations that collect, use or disclose personal information in the course of commercial activity. It applies in any of the following instances:

• The protection of personal information belonging to clients and employees of federally regulated organizations, such as airports, banks, inter-provincial transportation companies, telecommunications companies, radio broadcasters, etc., that conduct business in Canada.
• Organizations that, in the course of their commercial activities, collect, use, and disclose personal information within a province, except where the province's privacy laws are deemed to be "substantially similar" to PIPEDA (as is the case in the following provinces - Alberta, British Columbia, and Quebec).
• All businesses handling information that crosses either a provincial or the national border, in the course of commercial activities, regardless of the province.

The federal government's power to enact PIPEDA derives from its authority to regulate trade and commerce under section 91(2) of the Constitution Act, 1867 (the Constitution). In 2004, the government of Quebec initiated a reference case to challenge the constitutionality of PIPEDA, arguing that it impinged on the legislative competence of the provinces over property and civil rights within the provinces (s. 92(13)). This was later dropped.[2]

The argument for federal authority for PIPEDA by some constitutional lawyers is that, in pith and substance, it is primarily concerned with regulating the commercial exploitation of personal information. Therefore, any effects on provincial matters are subsidiary to this primary federal objective, and a necessary incident of the exercise of the federal government’s extra-provincial trade and commerce power.[3]

To avoid constitutional challenges to the legislation, the drafters of PIPEDA struck a compromise by giving opportunity to the provinces for exemption, on the condition that they adopt substantially similar laws (section 26(2)(b). As it stands, the following provinces have enacted their own private sector privacy laws: Alberta enacted its Personal Information Protection Act (Alberta's PIPA)[4]; British Columbia enacted its own Personal Information Protection Act, S.B.C. 2003, (BC's PIPA); and Québec has An Act Respecting the Protection of Personal Information in the Private Sector, R.S.Q., (Québec Privacy Act). Consequently, organizations that, in the course of commercial activities, manage personal information within these provinces are governed by their respective provincial privacy legislation, in areas where the provincial legislation overlaps with PIPEDA.

The CPPA

Just as PIPEDA before it, section 6(2)(b) of the proposed CPPA brings under its purview, all personal information collected, used or disclosed by an organization in the course of its commercial activities within a province, "to the extent that the organization is not exempt from the application of this Act under an order made under paragraph 122(2)(b)."[5].

Paragraph 122(2)(b) gives the Governor in Council the power to make an order if it is satisfied that the legislation of a province that is substantially similar to the CPPA applies to an organization or an activity, and as a result exempt such organization or activity from the applicability of the CPPA.

This means that provinces with their own private sector privacy laws must update their laws to comply with the new CPPA, otherwise the exemption status currently enjoyed by the province under PIPEDA will effectively be revoked when the proposed CPPA comes into effect. At the same time, the other Canadian provinces and territories that have not enacted their own private sector privacy legislation will become subject to the new CPPA in place of the repealed PIPEDA. 

It is not clear if any grace period will be extended to provinces with their own private sector privacy laws, to enable them update their laws, prior to section 6(2)(b) coming into effect. However, section 122(3) gives the Governor in Council the power to make regulations establishing applicable criteria and the process for determining that a provincial legislation is substantially similar to the CPPA. One expects that the Governor in Council will use these broad powers to help make the transition a seamless one for the provinces concerned.

Quebec has enacted a new legislation in Bill 64, An Act to modernize legislative provisions as regards the protection of personal information (Quebec's Bill 64), overhauling its current private sector privacy laws. Quebec's Bill 64 (also known as Law 25) received royal assent on September 22, 2021, and will replace the current Act in a phased manner, until late 2023 when most of the changes will become operational.[6]

On the 9th of December 2020, the B.C. legislature appointed a special committee to review BC's PIPA. As part of the exercise, the B.C. Commissioner submitted the recommendations to this special committee, most of which were in alignment with, or went further than, the changes anticipated in the former Bill C-11, An Act to enact the Consumer Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts (Bill C-11), a predecessor of Bill C-27, which died in the 2021 legislative session.[7]

Calls for changes in Alberta

Alberta, the last of the three jurisdictions with its own private sector privacy legislation, now has some work to do to bring its current legislation into alignment with the anticipated changes at the federal level.

In her November 2020 letter to the Minister of Service Alberta, the former Information and Privacy Commissioner (the IPC) called for reforms in Alberta's privacy laws. She emphasized the need to bring Alberta's PIPA in line with the now-defunct Bill C-11, in order to avoid any impact on the PIPA's "substantially similar" standing federally. Included in the commissioner's letter, were some ideas for modernizing Alberta's PIPA, many of which reflect the changes in the CPPA.

While presenting the 2020 to 2021 Annual Report, the IPC also commended the flexibility of the existing framework and its support for robust assessment of new technologies. However, she admitted that the new technologies are straining the existing legislative models beyond their limits. She reported that consultations are currently ongoing within the Alberta government on engaging the general public and other stakeholders, to bring about the needed changes to the laws to mirror the changes in other parts of Canada.[8]

Overview of the review process in Alberta

Section 63 of Alberta's PIPA provides for a comprehensive review of its provisions by a special committee of the Legislative Assembly every six years after the date on which the previous special committee submits its final report. In compliance with this provision, Alberta legislature passed Government Motion 29 on May 25, 2022, referring the PIPA to the Standing Committee on Alberta's Economic Future, to serve as the special committee for conducting a comprehensive review, as required by the Act, and allow for stakeholder input from the public through written submissions. The committee is expected to present its report to the Legislative Assembly within 18 months of inception, in accordance with section 63(2) of the Act.

The Committee met on the 27th of September 2022, and according to the meeting transcript posted on its webpage, discussed seeking a full and adequate understanding of PIPA, by inviting technical briefings from Service Alberta (the ministry responsible for administering the PIPA) and the office of the IPC, at a future meeting of the committee. The committee adjourned its meeting acknowledging its commitment to conclude its work and present a report to the Legislative Assembly by March 27, 2024.[9]

Conclusion

As Bill C-27 makes it way through the legislative rounds, the changes anticipated may result in the revocation of the current PIPA for not being substantially similar to the proposed CPPA. It is hoped that the Alberta Legislature will close the gap soon enough with a revision of the PIPA that aligns closely with the new CPPA, so that organizations in Alberta can continue to enjoy exemption from the proposed CPPA when it comes into effect, on account of Alberta's "substantially similar" standing.

[1] Government Bill (House of Commons) C-27 (44-1) - First Reading - Digital Charter Implementation Act, 2022 - Parliament of Canada
[2] Fresh Questions about the Constitutionality of PIPEDA? By Teresa Scassa (teresascassa.ca)
[3] PIPEDA: A Constitutional Analysis | CanLII
[4] Personal Information Protection Act, SA 2003, [PIPA].
[5] Government Bill (House of Commons) C-27 (44-1) - First Reading - Digital Charter Implementation Act, 2022 - Parliament of Canada
[6] Canada’s freight train of privacy legislative reform continues - Legal Year in Review 2021 | Osler
[7] Comparison of BC OIPC’s Submissions on PIPA reform and OPC Submission on C-11 - Office of the Privacy Commissioner of Canada
[8] Office of the Information and Privacy Commissioner of Alberta | 2020-21 ANNUAL REPORT
[9] 20220927_0900_01_ef.pdf (assembly.ab.ca)
[10] 2020-10-16-ipc-private-sector-consultation-submission.pdf