Key details on the new Bill C-11:
Creates a new Consumer Privacy Protection Act (CPPA), removes the electronic documents part of PIPEDA to a standalone act
new Personal Information and Data Protection Tribunal to administer penalties and review privacy commissioner orders /1

Big new penalties available - highest in the G7:
fines of up to 5% of global revenue or $25 million for
the most serious offences, and penalties of up to 3% of global revenue or $10 million for other
violations /2

Data portability - require organization to transfer data to another organization
Algorithmic transparency - right to request that businesses explain how a prediction,
recommendation or decision was made by an automated decision-making system /3

Big for business:
allow organizations to ask the Privacy Commissioner to approve codes of practice and certification systems
allow businesses to
disclose de-identified data to public entities (under certain circumstances) for socially
beneficial purposes /4

Consent provisions require careful study. Govt says use of personal info often core to delivery of a product or service, and consumers reasonably expect that their info will be used for this purpose. So no need for consent where it doesn’t provide meaningful privacy protection /5

One of the notable (and welcome) things about this bill is the elimination of the reliance on the CSA Model Code in Schedule 1 as the foundation of the privacy rules. The privacy obligations are now embedded within the law. /6

The enforcement side of the privacy is subject to a huge overhaul: order making power for the privacy commissioner, reviews of the orders by the new tribunal, and big penalties available for non-compliance. Privacy commissioner order has same effect as Federal Court order. /7

The bill also includes a new private right of action. Individuals can sue where the commissioner issues a finding of a privacy violation and it is upheld by the Tribunal. Case must be brought within two years. /8