Ontario moves forward with privacy legislation initiative

Éloïse Gratton June 23, 2021

Ontario has taken a significant step towards implementing private sector privacy legislation in the province.

On June 17, it issued a white paper entitled Modernizing Privacy in Ontario that sets out a model for a new statute. The province aims to implement stronger protections than introduced by the federal government in its privacy reform bill, Bill C-11. If the province’s proposed model becomes law, it will bring in a strict new compliance and enforcement regime and entirely new employment privacy regulation. It will also increase the fragmentation of the Canadian private sector privacy law regime.

The context for reform

Federal law currently governs commercial privacy in Ontario. The Personal Information Protection and Electronic Documents Act (PIPEDA) has imposed a broad set of privacy-related requirements that are based on fair information practice principles – a set of fundamental principles for protecting privacy that have become the basis of global privacy laws.

PIPEDA, however, has three fundamental limitations:

  • First, it does not yet feature elements now common to stronger privacy laws, such as the European Union’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act of 2018 (CCPA).
  • Second, enforcement under PIPEDA is based on an Ombudsman model. The regulator, the Office of the Privacy Commissioner of Canada, has no power to make orders or issue fines.
  • Third, PIPEDA applies to a small segment of Ontario employers – only banks, airlines and other federally regulated employers. The vast majority of employers in Ontario have no obligations under a plenary privacy statute.

Based on concerns about PIPEDA’s frailties and a need to maintain the “adequacy status” that facilitates the transfer of personal information outside of the European Economic Area under the GDPR, Canada has seen a wave of privacy law reform – indeed, a near competition to establish the new baseline for privacy protection in Canada.

Québec led first, with a stringent set of reforms embodied in Bill 64. Bill 64 is expected to pass by the end of 2021.

The federal government followed with Bill C-11, a bill that would replace PIPEDA with the Consumer Privacy Protection Act. Bill C-11 has faced significant criticism from privacy advocates and the Office of the Privacy Commissioner of Canada, raising significant questions about its future.

This content has been updated on May 2, 2024 at 16 h 33 min.