CanadaBill C-36, Protecting Privacy and Consumer Data Act
Bill C-36 An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, 45th Parliament, 1st Session
A comprehensive regime rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator, Registered or designated auditor
- Where the report goes
- Filed with regulator
What it requires
- Would require organizations to be transparent about their use of automated decision making for significant decisions about individuals, set higher standards for handling children's information, and obtain meaningful consent supported by plain-language explanations.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which predictions, recommendations or decisions 'could have a legal or similarly significant effect on them' under section 63(4) of the Protecting Privacy and Consumer Data Act, the trigger for an individual's right to an explanation of an automated decision?
- How much re-identification risk is consistent with 'no reasonably foreseeable risk in the circumstances that an individual can be identified from the information', the test in the definition of anonymize in the Protecting Privacy and Consumer Data Act?
What it makes you log
Who may demand the log
Regulator
Logging duty
Answered on the first reading text of the bill, which is at second reading in the House of Commons and not law. Clause 60(1) would require a record of every breach of security safeguards, kept in accordance with prescribed requirements, and clause 60(2) would give the Commission access to or a copy of it on request. Clause 18(5) would require the organization to record its description of a legitimate interest and give the Commission that description and its assessment on request. Clause 118 would let the Commissioner audit on reasonable grounds, and clause 119 would let the Commissioner require a report from a third party the Commissioner approves, submitted to the Commissioner. The bill sets no contents or period for the records.
- Kind
- Explicit
- As of
- Provision
- Clauses 60(1) and 18(5)
- Trigger
- security_incident
- personal_data_processing
What this law does
Would enact the Protecting Privacy and Consumer Data Act and amend PIPEDA to modernize Canada's private-sector privacy law, sponsored by the Minister of Artificial Intelligence and Digital Innovation.
Proposed new requirements include recognizing privacy as a fundamental right, higher standards for organizations handling children's information, meaningful consent with plain-language explanations, transparency about the use of automated decision making for significant decisions about individuals, and a right to request deletion of personal information. Introduced and given first reading .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions, operates a social platform, serves under-18s, operates an app store, ships a mobile app, reuses other publishers' content or processes personal data.
Back to the example · Lint your app
Page updated .