After the Pandemic: Modernizing our data privacy laws

Timing isn't everything, but it can't be ignored, can it? Just as we were about to release our podcast interview with privacy lawyer Sinziana Gutiu on the upcoming push to reform privacy law in Canada, the federal government tabled Bill C-11, a new privacy bill which will be known as the Consumer Privacy Protection Act. But I invite you to still listen to it as much of our conversation is germane to what we will continue to debate over the coming months.

As we've reported, Bill C-11 aims to give Canadians more meaningful consent over the use by others of their personal data while offering businesses a more flexible privacy framework to compete in the digital economy. The bill also gives more enforcement powers to the Office of the Privacy Commissioner of Canada and creates a new tribunal that can impose penalties for violations under the new law — not unlike those under the EU's General Data Protection Regulation, or GDPR. In fact, the bill is really part of a larger effort to bring our privacy regime in line with Europe's. 

As Gutiu explains in the interview, the EU's determination if Canada has an adequate level of data protection – which we call adequacy – is a key concern for our lawmakers, increasingly under pressure to modernize our regime. It's why Québec's new privacy bill, introduced in the summer, also draws inspiration from the GDPR.

However, one of the challenges moving forward will be for provinces with substantially similar privacy law as our current federal law, the Personal Information Protection and Electronic Documents Act. According to Gutiu, it's "extremely important" for governments across Canada to develop consistent legislation, especially for smaller companies for whom it can be costly to do business in multiple jurisdictions.

It's also worth remembering that much of privacy law reform is about strengthening our competitive position in a global digital economy. Getting privacy laws right is somewhat akin to developing the right fiscal policy in a way that shapes a country's competitiveness and that of its industries. And there is little doubt that Bill C-11. "For encouraging businesses to come and provide their services and goods in Canada within specific provinces, consistent legislation is really important," Gutiu points out.

Throughout the interview, we also discuss a range of privacy issues from consent fatigue – something Bill C-11 appears to be trying to remedy – to the importance of giving a privacy watchdog sufficient resources to enforce the law.

My favourite part of the conversation is nearer to the end. Gutiu shares her insight on how we need to approach privacy, keeping in mind future technological advances, such as the "internet of thinking." It's a notion developed by futurist Ray Kurzweil, who envisions a time in the not-so-distant future when our thoughts will be "a hybrid of biological and non-biological thinking." While the concept sounds a bit sci-fi, there are already early examples of uses of this type of technology, particularly in the health sector (think of chemotherapy treatments combined with sensors, for example). More to the point, however, Gutiu cautions us not to think about data as a finite resource or a commodity, as we would oil (it would seem data is not the new oil, after all), but more like something akin to air. And air, of course, "comes with a whole ecosystem" that gets "renewed and replenished." It also needs to be protected because it "can be polluted."

And how do we do that when no one owns it?

Listen to After the pandemic (Ep. 07): Modernizing our data privacy laws.