Torys LLP Privacy Counsel Molly Reynolds and Associate Ronak Shah sit down to discuss the Digital Charter initiative which outlines proposals to modernize Canada’s privacy laws, including the Personal Information Protection and Electronic Documents Act. The pair talk about the Charter's principles that will guide future policy making, how much substance there is behind them and what businesses can expect over the next few years.
Music: Stratosphere - www.adamvitovsky.com.
Torys LLP Privacy Counsel Molly Reynolds and Associate Ronak Shah sit down to discuss the Digital Charter initiative which outlines proposals to modernize Canada’s privacy laws, including the Personal Information Protection and Electronic Documents Act. The pair talk about the Charter's principles that will guide future policy making, how much substance there is behind them and what businesses can expect over the next few years.
Music: Stratosphere - www.adamvitovsky.com.
Welcome to Tori's in 10 where we explore important legal and business developments in just 10 minutes and discuss how they may affect your organization.
Speaker 2:Hi, I'm Molly Reynolds. I'm privacy counsel here at Tory's. Okay.
Speaker 3:And I am RONIC shy. I'm an associate in the privacy and technology group at Tory's.
Speaker 2:And today we're going to talk about the digital charter. So digital charter, bit of a buzz word. Now, we've been hearing a lot about it in the last couple of months, but I think there's questions about what this really is and what it means for Canada. So let's jump right in. RONIC what is the digital charter?
Speaker 3:It basically is a set of broad principles, 10 principles, which, um, act as a bit of a roadmap, uh, that will inform the federal government's policies, programs, and legislative agenda as it relates to data and the digital economy. Uh, what it is not, is not a new law. Um, it's not a charter in the sense of a charter of rights. It doesn't confer any new privacy rights on anyone. Um, and so these are basically 10 principles, like almost like an ethical framework. Um, and they can be broken down into, I'd say, like four different baskets of, um, principles of the first set of principles can be, are focusing on enhancing the obligations of the private sector. So one of the principles is control and the consent principles. So this, uh, the aim of this is to provide, uh, uh, more control to Canadians over how their data is shared, how it is used. The second basket focuses on enhancing the public sectors obligations, um, around data and digital innovation. So, uh, one of the principles around that is I'm looking at making sure that the government is open and digital, so people have access to services more digitally. Another one is looking at data and digital for the good, uh, which basically says the government will use, uh, all the data that they have more ethically and employ ethical frameworks. A third basket is focusing on, um, building public trust. So these principles are, um, looking at safety and security, um, and then addressing freedom, uh, from hate and violence. The last basket is basically around proactive policy making, uh, with a focus on data innovation beyond the regulate regulation functions. So things like universal access to the internet. Um, and so, uh, these principles, uh, that the government has outlined, uh, are not supposed to be static. They're supposed to be evolving over time. And this is just, uh, the starting foundation.
Speaker 2:So it all sounds good. And like laudable policy objectives. Is there much meat on the bones at this stage? So
Speaker 3:at the moment,
Speaker 2:I, these are just principles that are supposed to guide, uh, policymaking and there aren't, um, any concrete short term, uh, plans for the government. Uh, the government is looking, uh, to do a few legislative reforms. Uh, one of them is reforming pipit a, which is the private sector privacy, uh, law. Uh, and other one is they're looking at updating the privacy act, which governs how the federal institutions manage data. So there are some, um, uh, legislative reforms, but as we all know of legislative reforms take a long time. Um, and so it will happen in the next few years, but nothing imminent. Yeah, it's kinda funny. The, uh, document that announces the digital charter kind of Lodz the government's implementation of mandatory privacy breach reporting as a major area of privacy law reform. But that took 10 years of consultation and various legislative, uh, amendment efforts to get that into place. So it does sound like it's going to be a long row road ahead. And you know, at this stage it's been described as a framework. It's being described as a set of ethical principles and a charter. But it's interesting cause we're still kind of in the consultation phase and really socializing a lot of these ideas. And I say it's interesting because we've been in that consultation stage in Canada for a very long time. So you know, this, uh, digital charter was proceeded by a formal consultation process that ran for about six months last year in 2018, uh, before that the house of commons standing committee was looking at, um, potential amendments to pepita the private sector law and online reputation and published a report in 2018 that the federal government then issued a response to with potential amendments. And even now, you know, we have probably more detail and more of these categories and principles that you're talking about, but it's still really is at the exploratory stage. And I think they're at the point of identifying the existing legislation that they might tweak, identifying the different areas of law that might be engaged here, but we're not really seeing proactive proposals for what the specific obligations are going to be. Um, and where we are seeing it. Of course, that's really going to be subject to a whole bunch of debate and perhaps, you know, policy changes as this moves from conceptual phase through the consultation and really into more of a legislative amendment or a bill that's actually being debated. But a lot of these, um, principles that are better being addressed in the charter I think still are relevant and are certainly issues that have been discussed in many other areas, uh, for many years. And you know, the charter points, I think largely to the erosion of public trust in the online space and the number of ways that people's information can be used against them or large, uh, volumes of commercial data. Can be used for negative purposes or for harm or fraud. And that's certainly something we've seen discussed in the news all the time. So we see the Cambridge Analytica scandal with Facebook. We see, um, all kinds of coverage of data breaches in the news, um, deep fakes and you know, fake videos and the, uh, sort of viral nature of inappropriate content like the video resulting from the Christ chart church shooting. Um, these are social issues. They're issues in the media, you know, it's of public importance and so it makes a lot of sense for the government to be trying to tackle a lot of the issues in one document or in one framework and bring them together. Um, but certainly it's not going to be a matter of just introducing one bill or your one new law. It really is going to be engaging these various existing instruments that we have. And that's probably gonna make it more complicated.
Speaker 3:Absolutely. And I think what is also interesting, interesting is this part of it is obviously addressing this issue of a lack of trust, uh, in the way data is handled. But I think the other issue is the government wants to make sure that it creates a competitive, uh, uh, innovation system and framework that will allow companies to be able to use data. And so there's a ying and yang of trying to, to, to be able to provide the protections for the consumer, but also making sure that it doesn't stifle innovation. And so I think this is a fundamental problem that we've probably seen like the, the pivot or talks about the purpose of it being, uh, uh, trying to promote privacy rights but also innovation. And so this is a continuous, uh, struggle, I think legislation, um, that wants to allow innovation kind of struggles with. Um, and so the focus being both, uh, uh, data privacy and data innovation there is, I thought, I think there'll be an interesting to see how it develops
Speaker 2:to, uh, into action. And there's some interesting international components here too, right? So, in addition to this pretty lengthy consultation process that federal government and house of commons committee were engaged in over the last few years. You know, as part of this project, the government was looking at international standards and approaches as well. So they looked at the OEC D digital government project. They looked at, uh, some[inaudible] initiatives, um, that had been underway in terms of international principles for, you know, data governance and digital innovation and fostering innovation. And of course, we've been talking a lot about international trade obligations recently too. And how, you know, a domestic approach to, uh, digital governance can really play into those international obligations, especially in the
Speaker 3:white paper that they released that discusses the, the, uh, private sector reform. Uh, the proposed private sector reform, a reoccurring word was interoperability. And I think that that sense of being able to continue, uh, data flows and making sure that Canada's digital strategy is in line with our global, um, partners is something that, uh, is, is seen both in the digital charter, uh, through like things like data portability and open banking. Um, but also in specifically in saying this white paper as well, where they talk about, um, wanting to make sure that there's like data flows there, uh, and wanting to be aligned with the EU, especially with the, their change in legislation. Um, with GDPR. I think a part of the impetus behind some of this, uh, legislative reform is to make sure that we continue to keep our adequacy standing.
Speaker 2:And let's talk about that a little bit in terms of what the next steps are. So, um, in terms of this adequacy standing, we know that Canada has been deemed by the EU commission to have private sector privacy laws that are effectively equivalent to EU laws. And that allows us to have a free flow of data between EU countries and Canada, which is great for innovation and great for multinational businesses. And that's coming up for review in 2020 by the EU commission with the new GDPR and heightened privacy rules in the EU. So what does that mean in terms of timing for legislative reform under the digital charter or amendments to Canada's privacy legislation as a result?
Speaker 3:So in my discussions with, uh, with the, with I said, um, they were saying that they want to have a, um, consultation process that will continue until the end of the summer. And so they're welcoming, um, organizations, feedback, uh, on their, um, on the, on the reforms that are proposed in the white paper for pepita. Um, and then, uh, depending on the EU adequacy, uh, report that comes out in early January next year, that would be the starting point of the legislative, uh, amendment process. So I think in the short term there is obviously, uh, um, organizations can provide their input, uh, to the consultation to the consultation. Uh, but in the longterm we'll, we'll probably won't see any major change for another two or three years. Um, if we use Japan or South Korea as the adequacy, um, example, cause when you in Japan got into negotiations to, for their adequacy standing, it took two or three years. I think any private sector, uh, would take them
Speaker 2:that long. And it's funny, it's easy. We're in an election year to say, you know, all of this is great to put out publicly, but, um, this meal change after the election. But I think your view ironic was that these are continuing issues, right? Public trust, maintaining free flows of data with international partners. It's going to be an issue for any government, any political party. Um, so we may be in this lengthy consultation process, we may be in this legislative reform process for a few years, but it's unlikely to get dropped entirely. And that's really one of the reasons why it's relevant to understand the framework in this charter because it's unlikely to just disappear. Absolutely. And I think these issues are not going to go away. Um, and so, uh, it's going to be an interesting, uh, space to watch in the next few years and we're looking forward to continuing this discussion, uh, over the next, the next few years. Absolutely. And we do have a detailed bulletin already online on the digital charter. If you want more info,
Speaker 1:thanks for listening. You can find more insights from our lawyers on Tori's dot com.