Budget bill will transform privacy in Canada
A budget-implementation bill is an unlikely — and many would say inappropriate — place to make major changes to Canadian privacy law. Yet Bill C-59, the government’s 158-page bill that is set to sweep through the House of Commons, does just that.
The omnibus budget bill touches on a wide range of issues, including copyright term extension and retroactive reforms to access-to-information laws. But there are also privacy amendments that have received little attention.
In fact, the privacy commissioner of Canada was not even granted the opportunity to appear before the committee that “studied” the bill, meaning that privacy was not discussed nor analyzed (the committee devoted only two sessions to external witnesses for study, meaning most issues were glossed over).
The bill raises at least three privacy-related concerns. First, the retroactive reforms to access to information, which are designed to backdate the application of privacy and access-to-information laws to data from the long-gun registry, has implications for the privacy rights of Canadians whose data is still contained in the registry. By backdating the law, the government is effectively removing the privacy protections associated with that information.
Second, the government plans to expand its collection of biometric information, including fingerprints and digital photos, to visitors from 150 countries. The law currently applies to 29 countries and one territory, meaning this constitutes a massive expansion in the amount of personal data the government collects.
The regulations associated with the biometric data collection have yet to be released, but the expansion raises privacy concerns over how the information is stored, the potential for false matches and the need for appropriate notices about the collection, use and potential dis- closure of the gathered information.
Third, the government is expanding the scope of the Personal Information Protection and Electronic Documents Act (PIPEDA), the private-sector privacy law, to include non-commercial organizations. That raises questions about whether the changes are constitutional. The bill allows the government to specify organizations to which PIPEDA applies and it immediately adds one organization: the Montreal-based World Anti-Doping Agency (WADA).
The change is designed to address European criticism that WADA, which is currently subject to Quebec’s private-sector privacy law, is not governed by privacy laws that meet the adequacy standard under European law. The European goal appears to be to deem Montreal unfit to host WADA and to transfer its offices. The Canadian government wants to stop the privacy criticisms by applying the federal law to the global organization.
While these issues sound very technical, the problem with the government’s proposed reform is that it is an obvious target for a constitutional challenge.
When PIPEDA was first introduced in the late 1990s, the government was careful to limit its scope to commercial activities. The reason was that the Constitution Act grants provinces powers over property and civil rights, which is where privacy fits in. To get around provincial jurisdiction, the federal government sought to regulate privacy on a national basis by relying on its trade and commerce power. In fact, Quebec viewed even that justification as an encroachment on its powers and quickly launched a constitutional challenge against the law, but that case has remained dormant for years.
By extending the law to cover WADA, the government is reviving the constitutional issue by changing the entire scope of the law. If PIPEDA now also covers some noncommercial activities, it will need a different constitutional basis.
By including constitutionally suspect privacy provisions within Bill C-59, the government is proposing to solve one problem by creating a much bigger one.
Indeed, critics would argue that is precisely the risk of introducing significant privacy reforms within a fast-tracked omnibus budget bill and not allocating any time to discussing it at committee. Michael Geist holds the Canada Research Chair in Internet and E-commerce Law at the University of Ottawa, Faculty of Law. He can be reached at mgeist@uottawa.ca or at michaelgeist.ca.