(Ottawa) In the last interview of his mandate, the Privacy Commissioner of Canada, Daniel Therrien, does not hide being jealous of Bill 64 in Quebec, which modernized the protection of personal information. This new legislative framework adopted last September imposes financial penalties of up to 25 million.
Posted at 8:00 a.m.
“I hope that’s what we’ll see in the federal bill,” he said in an interview with The Pressthe day before his retirement.
A few days earlier, the Minister of Innovation, Science and Industry, François-Philippe Champagne, had indicated his intention to create a Digital Charter to better protect consumer privacy. The bill was previously introduced in 2020, but died on the order paper after the last federal election campaign kicked off.
“If you look back 10, 15 or 20 years ago, privacy cases were often seen as rather esoteric matters, rather as things of interest to technologists,” he remarked.
The proliferation of the use of personal data for commercial purposes and the resulting scandals have led to an awareness that failure to respect privacy could infringe fundamental rights, he said.
“The Cambridge Analytica affair, for example, demonstrates that badly controlled, badly done intelligence gathering can have results on democracy – it’s not nothing,” he said. The British firm had misappropriated personal data of Facebook users in an attempt to influence the US presidential election that brought Donald Trump to power in 2016.
From national security to capitalism
Privacy concerns have evolved significantly since the arrival of Daniel Therrien at the Office of the Privacy Commissioner of Canada in 2014. At the time, there were concerns about government abuses on behalf of national security in the wake of the revelations of the American whistleblower Edward Snowden.
“There was an international discussion, of which Canada was a part, on the limits in the collection and analysis of intelligence to succeed in protecting citizens and ensuring public safety,” he recalled.
Mechanisms for monitoring intelligence agencies have been established to ensure respect for rights, including the right to privacy.
Today, it is “surveillance capitalism” that is of concern, as evidenced by its latest report on Tim Hortons. The catering company’s mobile application tracked the movements of its customers. However, the federal legislative system is not at all adapted to this new reality.
The current laws are clearly deficient. The private sector law dates back five years before Facebook entered the scene; the public sector law dates from the 1980s where the fax was to be used, probably.
Daniel Therrien, Privacy Commissioner of Canada
In his final testimony before parliamentarians on Thursday, he insisted on the need for the next commissioner to have the power to issue compliance orders and impose fines proportionate to the staggering profits that web giants can generate “by disregarding privacy”.
Quebec law provides for fines of up to 25 million, or 4% of a company’s worldwide turnover, proportional to the seriousness of the offence. The most recent version of the federal bill provided for similar penalties.
In Quebec, companies must, in particular, destroy or anonymize personal information, obtain the person’s consent to use their data for commercial purposes and communicate the information collected to them if they so request. They must adapt to this new legislation gradually, according to a timetable defined by the government, until 2024.
“The law that was adopted in Quebec should certainly be a model to be studied at the federal level because there are several elements that we have [déjà] recommended, including a rights-based approach, the order-making power that is given to the Commission d’accès à l’information, significant financial penalties”, he underlined.
It is still necessary to have enough resources to proceed. In Quebec, the Commission d’accès à l’information, responsible for enforcing the law, is underfunded. In Ottawa, Daniel Therrien believes that his annual budget of $30 million is insufficient. “We think our budget should be doubled,” he said. His successor has still not been named.
The OPC currently has 200 employees to investigate privacy breaches by businesses and public bodies. In 2020-2021, they accepted a total of 1136 complaints.