From Cyberlex: Parliamentary Committee Recommends Substantial Revisions to PIPEDA - Part 2 – Consent
(See the original article by Kirsten Thompson, Charles Morgan and Maureen Gillis at McCarthy Tétrault's Cyberlex Blog: Parliamentary Committee Recommends Substantial Revisions to PIPEDA – Part 2 - Consent)
As reported in our recent post, on February 28, 2018, the House of Commons Standing Committee on Access to Information, Privacy and Ethics tabled in the House of Commons a report entitled Towards Privacy by Design: Review of the Personal Information Protection and Electronic Documents Act. The recommendations in the Committee’s Report are also heavily influenced by the direction set in the European Union General Data Protection Regulation, (“GDPR”) which comes into force this year.
We have prepared a multi-part series of posts focusing in more depth on each section of the Report.
In this post, we summarize and comment on the Committee’s findings set out in Part 2 of the Report, which addresses the issues of “meaningful consent” and the enhancement of the consent model, exceptions to the rule of consent, and data portability.
The other posts in this series are:
Part 2 – Consent
The concept of consent underpins the entire framework of PIPEDA. Essentially a contract-type model, this approach envisions an enlightened user who freely trades his or her personal information in exchange for services. The premise is that the best protection for personal information is therefore to create the conditions in which individuals are free to use their personal information as they wish. This ethos is stated in PIPEDA ‘s Principle 3 as “The knowledge and consent of the individual required for the collection, use and disclosure of personal information, except where inappropriate.” Further sub-principles articulate other aspects of consent, such as the necessary processes and timing in obtaining consent, types of consent, and how consent is to be made meaningful.
However, this consent model is under pressure from online technologies. The Report acknowledges this and begins by setting out the Office of the Privacy Commissioner of Canada’s (“OPC”) concern that innovation in information technologies has added significant complexity to online interactions and resulted in more ways to use information. As result, few individuals take the time to inform themselves of the conditions of use of their personal information. Compounding the problem, noted some witnesses, is that the privacy policies meant to inform individuals are often unreadable or too vague and consent obtained is illusory.
Notwithstanding the problems with the current consent model, most witnesses supported its continued use, albeit in modified form to address the current shortcomings. Many supported enhancements to implicit consent, including “deemed” consent when the risk of harm is low. Other witnesses cautioned against this approach, noting that if is often difficult to evaluate risk and potential harm beforehand.
Other witnesses supported implementing measures that would make consent more meaningful.
Enhancements to Consent
The overall recommendation of the Committee was ultimately that while consent should remain the core element of the privacy regime, it should be enhanced and clarified by additional means. The Report explores four areas in which the consent model could be enhanced and in some cases makes specific recommendations:
Exceptions to Consent
While consent underpins PIPEDA, the legislation also recognizes situations in which consent should not be required.