On December 13, 2019, Prime Minister Trudeau’s mandate letter to the Minister of Innovation, Science and Industry, called for the creation of a new federal Data Commissioner, as part of the advancement and implementation of the Digital Charter. Almost a year and half later, on April 19, 2021, the Liberal government released its 2021 Federal Budget, which provided a bit more detail on what organizations can expect from the new position.
What is a “data commissioner”?
As background, a “commissioner” is a public officer appointed by statute in order to perform specific public functions, though its roles and responsibilities vary widely. Based on the Federal Budget, the role of the Canadian Data Commissioner is to further the government’s goal of “helping Canadian businesses grow and succeed”.
Do other jurisdictions have data commissioners?
Yes – but not all “data commissioners” do the same thing. Europe has data protection commissioners (for instance, in Ireland, the Data Protection Commission), but these roles are generally responsible for upholding the right of individuals in the EU to have their personal data protected. In other words, a European data commissioner looks a lot like a Canadian privacy commissioner.
Australia has a Data Commissioner, and her role is to “provide oversight and regulation of the Australia’s new national data sharing and release framework, including monitoring and reporting on the operation of the framework and enforcing the accompanying legislation.” This is separate from the role fulfilled by privacy/data protection commissioners. Much of the Australian Data Commissioner’s role has to do with transparency and availability of government and public sector data.
What will the Canadian Data Commissioner do?
The Canadian Data Commissioner is a slightly different beast from other international data commissioners. It appears to be a hybrid animal, addressing issues of both non-personal and personal data. The Data Commissioner’s mandate will be to “inform government and business approaches to data-driven issues to help protect people’s personal data and to encourage innovation in the digital marketplace”. This dual mandate resembles the balanced purpose language found in the Personal Information Protection and Electronic Documents Act, as well as that found in Bill C-11. The 2021 Federal Budget’s Impacts Report further highlights the balanced purpose of protecting Canadians’ data and encouraging innovation, noting that “[a] well-functioning online marketplace and thriving data-driven technology sector benefits all Canadians by ensuring a proper balance with privacy protections and other social considerations”.
Notably, the Federal Budget indicates that the Data Commissioner is to oversee new regulations for “large digital companies” aimed at protecting individuals’ personal information and encourage greater competition in the digital marketplace. Presumably, “large digital companies” refers to the global behemoths, and the various concerns their scale and data sophistication have raised in some quarters. New regulations targeting these technologies and organizations could escape the trap of existing privacy legislation, which regulates only information about identifiable individuals, but is powerless to regulate the uses of the vast amounts of detailed information about individuals that stop short of identifying them.
Further, there is an indication that one of the Data Commissioner’s focus areas will be the use of data in artificial intelligence (“AI”) systems and, in particular, ensuring that AI systems do not perpetuate biases or historical disadvantages. The Impact Report refers to data and issues raised in the U.S., including how data used by AI systems can disadvantage certain groups in the U.S. health care system and that the Liberal government has similar concerns here in Canada, noting “[t]here can be biases in the data used by artificial intelligence systems that inform real life decisions that affect people’s lives, particularly historically disadvantaged demographic groups”.
The 2019 mandate letter stated that the Data Commissioner would also “continue work on the ethical use of data and digital tools like artificial intelligence for better government.”
Privacy Commissioner vs. Data Commissioner – who does what?
Much of this work would appear to overlap with that of the Office of the Privacy Commissioner of Canada and other privacy commissioners, notably the Commission d’ accès à l’ information du Québec. Québec’s proposed new privacy law, as set out in Bill 64, seeks specifically to regulate automated decision making systems and would require organizations provide information to individuals about:
- which personal information was used to render the decision;
- what are the reasons and the principal factors and parameters that led to the decision; and
- the right of the person whose personal information is collected to have the personal information used to render the decision corrected.
Bill 64 also states that the person must be given the opportunity to submit observations to a member of the personnel of the enterprise who is in a position to review the decision (for more on Bill 64, see our previous post here). Similar provisions have been proposed in the federal privacy bill, Bill C-11, which would create the Consumer Privacy Protection Act (“CPPA“) (for more on the CPPA, download a copy of Dentons CPPA In-depth Guide).
An additional player in the increasingly crowded data regulation field is Canada’s Competition Bureau, which in 2019 signaled that it was looking at data and the digital environment as a matter of competition law, and followed this in 2020 with a settlement that concluded that a social media platform had made false or misleading claims to the public about the privacy of Canadians’ personal information on its services. The social media platform disagreed with the conclusion of the Bureau, but wished to resolve the matter by entering into a consent agreement and not contesting the conclusions for purposes of the agreement, which required it to pay a $9 million penalty.
What are the takeaways for organizations?
Much is yet unknown at this point, including (as discussed above) how the scope of the Data Commissioner’s mandate will complement, or more likely overlap, with that of privacy commissioners and the Competition Bureau’s Chief Digital Enforcement Officer, as well as with the common law.
However, with an allocated $17.6 million over five years beginning in 2021/22, and $3.4 million per year going forward, a not insignificant amount, we should expect the Data Commissioner to have a significant impact on Canadian businesses and the policy environment.
For more information about Denton’s data expertise and how we can help, please see our Transformative Technologies and Data Strategy page and our unique Dentons Data suite of data solutions for every business, including enterprise privacy audits, privacy program reviews and implementation, and training in respect of personal information.
