PIPEDA also does not give the Office of the Privacy Commissioner of Canada (OPC) the power to issue orders or the power to impose fines, and the legislation lacks elements now common to the GDPR and to other privacy laws, she said. While Bill C-11 includes new enforcement tools and rights, it has been criticized by the OPC and fails to address the issue that PIPEDA does not apply to the majority of employers in the ‘Ontario, says Gratton.
Ontario’s proposals build on areas where the province has jurisdiction and not the federal government, Thompson said. An example of what is happening in the province is Ontario’s proposal to establish a âfundamental right to privacyâ.
Despite the language, the idea is not a âcarte blancheâ – privacy as a basic human right – but will be more constrained, she said. The use of the term âfundamental rightâ raises questions about the order and priorities of law and compliance.
âSo if you’re going to advertise something as a right, you usually want to define it pretty narrowly,â says Thompson. “And it’s kind of telegraphed here, because the white paper says that recognizing such a right would then require a clear definition of personal information.” And that, to me, suggests that there will be limits to that. “
Ontario indicates that its privacy legislation would be based on consent. Thompson says Canada is unusual among other countries based on consent. Although the GDPR sets out a number of legal bases for processing personal information, with user consent as a last resort, Canada is “turning that around”, requiring consent first, she said.