C-361453-4Charles III2025-2026An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other ActsAn Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other ActsAn Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection ...20266
15
MINISTER OF ARTIFICIAL INTELLIGENCE AND DIGITAL INNOVATION91270SUMMARYThis enactment enacts the Protecting Privacy and Consumer Data Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. Consequently, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act. Finally, it also makes amendments to other Acts.TABLE OF PROVISIONSAn Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other ActsProtecting Privacy and Consumer Data ActEnactment of ActAn Act to support and promote digital commerce by protecting personal information that is collected, used or disclosed in the course of commercial activitiesShort TitleProtecting Privacy and Consumer Data ActInterpretationDefinitionsOrder designating MinisterAuthorized representativesPurpose and ApplicationPurposeApplicationObligations of OrganizationsAccountability of OrganizationsAccountability — personal information under organization’s controlDesignated individualPrivacy management programAccess — privacy management programSame protectionAppropriate PurposesAppropriate purposesLimiting Collection, Use and DisclosureLimiting collectionNew purposeConsentConsent requiredConsent obtained by deceptionWithdrawal of consentExceptions to Requirement for ConsentBusiness ActivitiesBusiness activitiesTransfer to service providerDe-identification or anonymizationResearch, analysis and developmentProspective business transactionInformation produced in employment, business or professionEmployment relationship — federal work, undertaking or businessDisclosure to lawyer or notaryWitness statementPrevention, detection or suppression of fraudDebt collectionPublic InterestIndividual’s interestEmergency — useEmergency — disclosureIdentification of individualCommunication with next of kin or authorized representativeFinancial abuseRecords of historical or archival importanceDisclosure after period of timeJournalistic, artistic or literary purposesInvestigationsBreach of agreement or contraventionUse for investigationsBreach of security safeguardsProceeds of Crime (Money Laundering) and Terrorist Financing ActDisclosures to Government InstitutionsAdministering law — request of government institutionLaw enforcement — request of government institutionContravention of law — initiative of organizationProceeds of Crime (Money Laundering) and Terrorist Financing ActNational security, defence or international affairs — request by government institutionNational security, defence or international affairs — initiative of organizationRequired by LawRequired by law — collectionSubpoena, warrant or orderPublicly Available InformationInformation specified by regulationsNon-application of Certain Exceptions — Electronic Addresses and Computer SystemsDefinitionsRetention and Disposal of Personal InformationPeriod for retention and disposalPersonal information used for decision-makingDisposal at individual’s requestAccuracy of Personal InformationAccuracy of informationSecurity SafeguardsSecurity safeguardsDisclosure or transfer outside of CanadaReport to CommissionNotification to organizationsRecordsService providersOpenness and TransparencyPolicies and practicesAccess to and Amendment of Personal InformationInformation and accessRequest in writingInformation to be providedPlain languageTime limitCosts for respondingRetention of informationWhen access prohibitedAmendment of personal informationMobility of Personal InformationData mobility frameworkChallenging ComplianceComplaints and requests for informationDe-identification of Personal InformationProportionality of technical and administrative measuresProhibitionCommission, Commissioner and DivisionCommissionPowers, duties and functionsFactors to take into accountInformation — powers, duties or functionsAgreements or arrangements — MinisterAgreements or arrangements — CRTC, Commissioner of Competition, etc.Consultations with provincesDisclosure of information to foreign stateAnnual reportDelegationCommissionerDesignationFactors to take into accountProhibition — use for initiating complaint or auditDelegationDivisionDivision establishedFactors to take into accountDelegationCodes of Practice and Certification ProgramsDefinition of entityCertification programResponse by DivisionApproval made publicFor greater certaintyRemediesFiling of ComplaintsContraventionInvestigation of Complaints and Dispute ResolutionInvestigation of complaint by CommissionerExceptionDiscontinuanceDispute resolution mechanismsCompliance AgreementsEntering into compliance agreementEffect of compliance agreementConclusion of Investigation, Penalties and OrdersNotification and reasonsComplaintCompliance agreementNotice of contravention — investigation of a complaintNotice of contravention — compliance agreementApplication for reviewDecisionInconsistent interestsRulesPenaltyMaximum penaltyPurpose of penaltyDebt due to His MajestyCertificate of defaultAuditsEnsure complianceReportCommissioner’s report and recommendationsPowers of the Commission and Commissioner — Investigations, Audits and ProceedingsInterim orderPowers of CommissionerRepresentationsInconsistent interestsRulesAppealsRight of appealAppeal with leaveDisposition of appealsEnforcement of OrdersCompliance orders — notice of contraventionFiling with CourtCostsPrivate Right of ActionDamages — contravention of ActCertificate Under Canada Evidence ActCertificate under Canada Evidence ActSecurity requirementsConfidentialityNot competent witnessProtection of Commission, Commissioner and DivisionDe-identified personal informationGeneralRegulationsData mobility frameworksDistinguishing — classesRegulations — codes of conduct and certification programsWhistleblowingProhibitionOffence and punishmentReview by parliamentary committeeComing into ForceOrder in councilPersonal Information Protection and Electronic Documents ActPersonal Information Protection and Electronic Documents ActDigital Safety and Data Protection Commission of CanadaDigital Safety Commission of Canada ActDigital Safety ActConsequential AmendmentsAccess to Information ActFinancial Administration ActPrivacy ActPublic Service Superannuation ActConsequential and Related Amendments, Transitional Provision, Coordinating Amendments and Coming into ForceConsequential and Related AmendmentsAccess to Information ActAeronautics ActCanada Evidence ActCanadian Radio-television and Telecommunications Commission ActCompetition ActCanada Business Corporations ActRailway Safety ActBroadcasting ActTelecommunications ActPublic Servants Disclosure Protection ActChapter 23 of the Statutes of Canada, 2010TerminologyReplacement of “Personal Information Protection and Electronic Documents Act”Transitional ProvisionRegulationsCoordinating Amendments2026, c. 3Coming into ForceOrder in councilHis Majesty, by and with the advice and consent of the Senate and House of Commons of Canada, enacts as follows:Protecting Privacy and Consumer Data Act
Enactment of ActThe Protecting Privacy and Consumer Data Act, whose text is as follows and whose schedule is set out in the schedule to this Act, is enacted:An Act to support and promote digital commerce by protecting personal information that is collected, used or disclosed in the course of commercial activitiesShort Title
Short titleThis Act may be cited as the Protecting Privacy and Consumer Data Act.
Interpretation
DefinitionsThe following definitions apply in this Act.alternative format, with respect to personal information, means a format that allows an individual with a sensory disability to read or listen to the personal information. (support de substitution)anonymize means to irreversibly and permanently modify personal information to ensure that there is no reasonably foreseeable risk in the circumstances that an individual can be identified from the information, whether directly or indirectly, by any means. (anonymiser)automated decision system means any technology that assists or replaces the judgment of human decision-makers through the use of a rules-based system, regression analysis, predictive analytics, machine learning, deep learning, a neural network or other technique. (système décisionnel automatisé)breach of security safeguards means the loss of, unauthorized access to or unauthorized disclosure of personal information resulting from a breach of an organization’s security safeguards that are referred to in section 56 or from a failure to establish those safeguards. (atteinte aux mesures de sécurité)business transaction includesthe purchase, sale or other acquisition or disposition of an organization or a part of an organization, or any of its assets;the merger or amalgamation of two or more organizations;the making of a loan or provision of other financing to an organization or a part of an organization;the creating of a charge on, or the taking of a security interest in or a security on, any assets or securities of an organization;the lease or licensing of any of an organization’s assets; andany other prescribed arrangement between two or more organizations to conduct a business activity. (transaction commerciale)Chairperson means the Chairperson of the Commission, as designated under subsection 17(1) of the Digital Safety and Data Protection Commission of Canada Act. (président)child means an individual who is under 18 years of age. (enfant)commercial activity means any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists. (activité commerciale)Commission means the Digital Safety and Data Protection Commission of Canada referred to in section 4 of the Digital Safety and Data Protection Commission of Canada Act. (Commission)Commissioner means the Privacy and Consumer Data Commissioner, as designated under subsection 85(1). (commissaire)de-identify means to modify personal information so that an individual cannot be directly identified from it, although a risk of the individual being identified remains. (dépersonnaliser)Division means the Privacy and Consumer Data Division established under section 89. (Section)dispose means to permanently and irreversibly delete personal information or to anonymize it. (retrait)federal work, undertaking or business means any work, undertaking or business that is within the legislative authority of Parliament. It includesa work, undertaking or business that is operated or carried on for or in connection with navigation and shipping, whether inland or maritime, including the operation of ships and transportation by ship anywhere in Canada;a railway, canal, telegraph or other work or undertaking that connects a province with another province, or that extends beyond the limits of a province;a line of ships that connects a province with another province, or that extends beyond the limits of a province;a ferry between a province and another province or between a province and a country other than Canada;aerodromes, aircraft or a line of air transportation;a radio broadcasting station;a bank or an authorized foreign bank as those terms are defined in section 2 of the Bank Act;a work that, although wholly situated within a province, is before or after its execution declared by Parliament to be for the general advantage of Canada or for the advantage of two or more provinces;a work, undertaking or business outside the exclusive legislative authority of the legislatures of the provinces; anda work, undertaking or business to which federal laws, as defined in section 2 of the Oceans Act, apply under section 20 of that Act and any regulations made under paragraph 26(1)(k) of that Act. (entreprises fédérales)Minister means the member of the King’s Privy Council for Canada designated under section 3 or, if no member is designated, the Minister of Industry. (ministre)organization includes an association, a partnership, a person or a trade union. (organisation)personal information means information about an identifiable individual, including information that is inferred about the individual. (renseignement personnel)prescribed means prescribed by regulation. (Version anglaise seulement)record means any documentary material, regardless of medium or form. (document)sensitive describes personal information in respect of which, taking into account the circumstances, an individual has a heightened expectation of privacy, including, as the case may be, a child’s personal information, personal information revealing an individual’s racial or ethnic origin, political opinions or religious or philosophical beliefs, an individual’s trade union membership, genetic information or health information, biometric information that is capable of uniquely identifying the individual or information concerning an individual’s sexual orientation. (caractère sensible)service provider means an organization, including a parent corporation, subsidiary, affiliate, contractor or subcontractor, that provides services for or on behalf of another organization to assist the organization in fulfilling its purposes. (fournisseur de services)Interpretation — de-identified personal informationFor greater certainty, de-identified personal information does not cease to be personal information.
Order designating MinisterThe Governor in Council may, by order, designate any member of the King’s Privy Council for Canada to be the Minister for the purposes of this Act.
Authorized representativesThe rights provided for under this Act, including any right of recourse, may be exercisedon behalf of a child, by a parent, guardian or tutor, unless the child wishes to personally exercise those rights and is capable of doing so;on behalf of an individual, other than a child, under a legal incapacity, by a person authorized by law to administer the affairs or property of that individual;on behalf of a deceased individual, by a person authorized by law to administer the estate or succession of that individual, but only for the purpose of that administration; andon behalf of any other individual, by a person authorized in writing by that individual to do so.
Purpose and Application
PurposeThe purpose of this Act is to establish — in an era in which data is constantly flowing across borders and geographical boundaries and significant economic activity relies on the analysis, circulation and exchange of personal information — rules to govern the protection of personal information in a manner that recognizes the fundamental right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
ApplicationThis Act applies to every organization in respect of personal information thatthe organization collects, uses or discloses in the course of commercial activities; oris about an employee of, or an applicant for employment with, the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business.For greater certaintyFor greater certainty, this Act applies in respect of personal informationthat is collected, used or disclosed interprovincially or internationally by an organization; orthat is collected, used or disclosed by an organization within a province, to the extent that the organization is not exempt from the application of this Act under an order made under paragraph 139(2)(b).ApplicationThis Act also applies to an organization set out in column 1 of the schedule in respect of personal information set out in column 2.Non-applicationThis Act does not apply toany government institution to which the Privacy Act applies;any individual in respect of personal information that the individual collects, uses or discloses solely for personal or domestic purposes;any organization in respect of personal information that the organization collects, uses or discloses solely for journalistic, artistic or literary purposes;any organization in respect of an individual’s personal information that the organization collects, uses or discloses solely for the purpose of communicating or facilitating communication with the individual in relation to their employment, business or profession; orany organization that is, under an order made under paragraph 139(2)(b), exempt from the application of this Act in respect of the collection, use or disclosure of personal information that occurs within a province in respect of which the order was made.For greater certaintyFor greater certainty, this Act does not apply in respect of anonymized information.Other ActsEvery provision of this Act applies despite any provision, enacted after December 31, 2000, of any other Act of Parliament, unless the other Act expressly declares that that provision operates despite the provision of this Act.
Obligations of OrganizationsAccountability of Organizations
Accountability — personal information under organization’s controlAn organization is accountable for personal information that is under its control.Personal information under organization’s controlPersonal information is under the control of the organization that decides to collect it and that determines the purposes for its collection, use or disclosure, regardless of whether the information is collected, used or disclosed by the organization itself or by a service provider on behalf of the organization.
Designated individualAn organization must designate one or more individuals to be responsible for matters related to its obligations under this Act. It must provide the designated individual’s business contact information to any person who requests it.Effect of designation of individualThe designation of an individual under subsection (1) does not relieve the organization of its obligations under this Act.
Privacy management programEvery organization must implement and maintain a privacy management program that includes the policies, practices and procedures the organization has put in place to fulfill its obligations under this Act, including policies, practices and procedures respectingthe protection of personal information;how requests for information and complaints are received and dealt with;the training and information provided to the organization’s staff respecting its policies, practices and procedures; andthe development of materials to explain the organization’s policies and procedures.Volume and sensitivityIn developing its privacy management program, the organization must take into account the volume of personal information under its control and the sensitivity of that information.
Access — privacy management programAn organization must, on request, provide the Commission with access to the policies, practices and procedures that are included in its privacy management program.Guidance and corrective measuresThe Commission may, after reviewing the policies, practices and procedures, provide guidance on, or recommend that corrective measures be taken by the organization in relation to, its privacy management program.
Same protectionIf an organization transfers personal information to a service provider, the organization must ensure, by contract or otherwise, that the service provider provides a level of protection in respect of the personal information equivalent to that which the organization is required to provide under this Act.Service provider obligationsThe obligations under this Part, other than those set out in sections 56 and 61, do not apply to a service provider in respect of personal information that is transferred to it. However, the service provider is subject to all of the obligations under this Part if it collects, uses or discloses that information for any purpose other than the purposes for which the information was transferred to it.
Appropriate Purposes
Appropriate purposesAn organization may collect, use or disclose personal information only in a manner and for purposes that a reasonable person would consider appropriate in the circumstances, whether or not consent is required under this Act.Factors to take into accountAll relevant factors must be taken into account in determining whether the manner and purposes referred to in subsection (1) are appropriate, including, if applicablethe sensitivity of the personal information;whether the purposes represent legitimate business needs of the organization;the degree of effectiveness of the collection, use or disclosure in meeting the organization’s legitimate business needs; whether there are less intrusive means of achieving those purposes at a comparable cost and with comparable benefits; andwhether the individual’s loss of privacy is proportionate to the benefits in light of the measures, technical or otherwise, implemented by the organization to mitigate the impacts of the loss of privacy on the individual.PurposesThe organization must determine at or before the time of the collection of any personal information each of the purposes for which the information is or is to be collected, used or disclosed and record those purposes.New purposeIf the organization determines that the personal information it has collected is to be used or disclosed for a new purpose, the organization must record that new purpose before using or disclosing that information for the new purpose.
Limiting Collection, Use and Disclosure
Limiting collectionAn organization may collect only the personal information that is necessary for the purposes determined and recorded under subsection 12(3).
New purposeAn organization must not use or disclose personal information for a purpose other than a purpose determined and recorded under subsection 12(3), unless the organization obtains the individual’s valid consent before any use or disclosure for that other purpose.Use or disclosure — other purposesDespite subsection (1), an organization mayuse personal information for a purpose other than a purpose determined and recorded under subsection 12(3) in any of the circumstances set out in sections 18, 20 and 21, subsections 22(1) and (3) and sections 23, 24, 26, 30, 39 and 50; ordisclose personal information for a purpose other than a purpose determined and recorded under subsection 12(3) in any of the circumstances set out in section 18, subsections 22(1) and (3), sections 23 to 28 and 31 to 36, subsection 38(3) and sections 40 to 50.
Consent
Consent requiredUnless this Act provides otherwise, an organization must obtain an individual’s valid consent for the collection, use or disclosure of the individual’s personal information.Timing of consentThe individual’s consent must be obtained at or before the time of the collection of the personal information or, if the information is to be used or disclosed for a purpose other than a purpose determined and recorded under subsection 12(3), before any use or disclosure of the information for that other purpose.Information for consent to be validThe individual’s consent is valid only if, at or before the time that the organization seeks the individual’s consent, the organization provides the individual with the following information:the purposes for the collection, use or disclosure of the personal information determined by the organization and recorded under subsection 12(3) or (4);the manner in which the personal information is to be collected, used or disclosed;any reasonably foreseeable consequences of the collection, use or disclosure of the personal information;the specific type of personal information that is to be collected, used or disclosed; andthe names of any third parties or types of third parties to which the organization may disclose the personal information.Plain languageThe organization must provide the information referred to in subsection (3) in plain language that an individual to whom the organization’s activities are directed would reasonably be expected to understand.Form of consentConsent must be expressly obtained unless, subject to subsection (6), it is appropriate to rely on an individual’s implied consent, taking into account the reasonable expectations of the individual and the sensitivity of the personal information that is to be collected, used or disclosed.Business activitiesIt is not appropriate to rely on an individual’s implied consent if their personal information is collected or used for an activity described in subsection 18(2) or if it is collected, used or disclosed for an activity described in subsection 18(3).Consent — provision of product or serviceThe organization must not, as a condition of the provision of a product or service, require an individual to consent to the collection, use or disclosure of their personal information beyond what is necessary to provide the product or service.
Consent obtained by deceptionAn organization must not obtain or attempt to obtain an individual’s consent by providing false or misleading information or using deceptive or misleading practices. Any consent obtained under those circumstances is invalid.
Withdrawal of consentOn giving reasonable notice to an organization, an individual may, at any time, subject to this Act, to federal or provincial law or to the reasonable terms of a contract, withdraw their consent in whole or in part.Collection, use or disclosure to ceaseOn receiving the notice from the individual, the organization must inform the individual of the consequences of the withdrawal of their consent and, as soon as feasible after that, cease the collection, use or disclosure of the individual’s personal information in respect of which the consent was withdrawn.
Exceptions to Requirement for ConsentBusiness Activities
Business activitiesAn organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of a business activity described in subsection (2) anda reasonable person would expect the collection or use for such an activity; andthe personal information is not collected or used for the purpose of influencing the individual’s behaviour or decisions.List of activitiesSubject to the regulations, the following activities are business activities for the purposes of subsection (1):an activity that is necessary to provide a product or service that the individual has requested from the organization;an activity that is necessary for the security of the organization’s information, systems or networks;an activity that is necessary for the safety of a product or service that the organization provides; andany other prescribed activity.Legitimate interestAn organization may collect, use or disclose an individual’s personal information without their knowledge or consent if the collection, use or disclosure is made for the purpose of an activity in which the organization has a legitimate interest that outweighs any reasonably foreseeable adverse effect on the individual that could result from that collection, use or disclosure anda reasonable person would expect the collection, use or disclosure for such an activity; andthe personal information is not collected, used or disclosed for the purpose of influencing the individual’s behaviour or decisions.Conditions precedentBefore collecting, using or disclosing personal information under subsection (3), the organization mustidentify and describe its legitimate interest in the proposed activity;carry out, in accordance with the prescribed requirements, a privacy impact assessment in which the organization must identify any reasonably foreseeable adverse effect on the individual that is likely to result from the collection, use or disclosure;identify and take reasonable measures to reduce the likelihood that the effects will occur or to mitigate or eliminate them; andcomply with any prescribed requirements.RecordThe organization must record the description of its legitimate interest and must, on request, provide the Commission with access to, or a copy of, the description and assessment.
Transfer to service providerAn organization may transfer an individual’s personal information to a service provider without their knowledge or consent.
De-identification or anonymizationAn organization may use an individual’s personal information without their knowledge or consent to de-identify or anonymize the information.
Research, analysis and developmentAn organization may use an individual’s personal information without their knowledge or consent for the organization’s internal research, analysis and development purposes if the information is de-identified before it is used.
Prospective business transactionOrganizations that are parties to a prospective business transaction may use and disclose an individual’s personal information without their knowledge or consent ifthe information is de-identified before it is used or disclosed and remains so until the transaction is completed;the organizations have entered into an agreement that requires the organization that receives the informationto use and disclose that information solely for purposes related to the transaction,to protect the information by security safeguards proportionate to the sensitivity of the information, andif the transaction does not proceed, to return the information to the organization that disclosed it, or dispose of it, within a reasonable time;the organizations comply with the terms of that agreement; andthe information is necessaryto determine whether to proceed with the transaction, andif the determination is made to proceed with the transaction, to complete it.Exception — paragraph (1)(a)The requirement referred to in paragraph (1)(a) does not apply if it would undermine the objectives for carrying out the transaction and the organization has taken into account the risk of harm to the individual that could result from using or disclosing the information.Completed business transactionIf the business transaction is completed, the organizations that are parties to the transaction may use and disclose the personal information referred to in subsection (1) without the individual’s knowledge or consent ifthe organizations have entered into an agreement that requires each of themto use and disclose the information under its control solely for the purposes for which the information was collected or permitted to be used or disclosed before the transaction was completed,to protect that information by security safeguards proportionate to the sensitivity of the information, andto give effect to any withdrawal of consent made under subsection 17(1);the organizations comply with the terms of that agreement;the information is necessary for carrying on the business or activity that was the object of the transaction; andone of the parties notifies the individual, within a reasonable time after the transaction is completed, that the transaction has been completed and that their information has been disclosed under subsection (1).ExceptionSubsections (1) and (3) do not apply to a business transaction of which the primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information.
Information produced in employment, business or professionAn organization may collect, use or disclose an individual’s personal information without their knowledge or consent if it was produced by the individual in the course of their employment, business or profession and the collection, use or disclosure is consistent with the purposes for which the information was produced.
Employment relationship — federal work, undertaking or businessAn organization that operates a federal work, undertaking or business may collect, use or disclose an individual’s personal information without their consent ifthe collection, use or disclosure is necessary to establish, manage or terminate an employment relationship between the organization and the individual in connection with the operation of a federal work, undertaking or business; andthe organization has informed the individual that the personal information will be or may be collected, used or disclosed for those purposes.
Disclosure to lawyer or notaryAn organization may disclose an individual’s personal information without their knowledge or consent to a lawyer or, in Quebec, a lawyer or notary, who is representing the organization.
Witness statementAn organization may collect, use or disclose an individual’s personal information without their knowledge or consent if the information is contained in a witness statement and the collection, use or disclosure is necessary to assess, process or settle an insurance claim.
Prevention, detection or suppression of fraudAn organization may disclose an individual’s personal information to another organization without the individual’s knowledge or consent if the disclosure is reasonable for the purpose of detecting or suppressing fraud or of preventing fraud that is likely to be committed and it is reasonable to expect that the disclosure with the individual’s knowledge or consent would compromise the ability to prevent, detect or suppress the fraud.Collection or useAn organization may collect or use an individual’s personal information without their knowledge or consent if the information was disclosed to it under subsection (1).
Debt collectionAn organization may disclose an individual’s personal information without their knowledge or consent for the purpose of collecting a debt owed by the individual to the organization.
Public Interest
Individual’s interestAn organization may collect an individual’s personal information without their knowledge or consent if the collection is clearly in the interests of the individual and consent cannot be obtained in a timely way.UseAn organization may use an individual’s personal information without their knowledge or consent if the information was collected under subsection (1).
Emergency — useAn organization may use an individual’s personal information without their knowledge or consent for the purpose of acting in respect of an emergency that threatens the life, health or security of any individual.
Emergency — disclosureAn organization may disclose an individual’s personal information without their knowledge or consent to a person who needs the information because of an emergency that threatens the life, health or security of any individual. If the individual whom the information is about is alive, the organization must, in writing and without delay, inform that individual of the disclosure.
Identification of individualAn organization may disclose an individual’s personal information without their knowledge or consent if the disclosure is necessary to identify the individual who is injured, ill or deceased and is made to a government institution, a part of a government institution or the individual’s next of kin or authorized representative. If the individual is alive, the organization must, in writing and without delay, inform them of the disclosure.
Communication with next of kin or authorized representativeAn organization may disclose an individual’s personal information without their knowledge or consent to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that the disclosure is requested for the purpose of communicating with the next of kin or authorized representative of an injured, ill or deceased individual.
Financial abuseAn organization may on its own initiative disclose an individual’s personal information without their knowledge or consent to a government institution, a part of a government institution or the individual’s next of kin or authorized representative ifthe organization has reasonable grounds to believe that the individual has been, is or may be the victim of financial abuse;the disclosure is made solely for purposes related to preventing or investigating the abuse; andit is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the ability to prevent or investigate the abuse.
Records of historical or archival importanceAn organization may disclose an individual’s personal information without their knowledge or consent to an institution whose functions include the conservation of records of historical or archival importance, if the disclosure is made for the purpose of such conservation.
Disclosure after period of timeAn organization may disclose an individual’s personal information without their knowledge or consent after the earlier of100 years after the record containing the information was created, and20 years after the death of the individual.
Journalistic, artistic or literary purposesAn organization may collect an individual’s personal information without their knowledge or consent if the collection is solely for journalistic, artistic or literary purposes.
Investigations
Breach of agreement or contraventionAn organization may collect an individual’s personal information without their knowledge or consent if it is reasonable to expect that the collection with their knowledge or consent would compromise the availability or the accuracy of the information and the collection is reasonably made for a purpose related to investigating a breach of an agreement or a contravention of federal or provincial law.UseAn organization may use an individual’s personal information without their knowledge or consent if the information was collected under subsection (1).DisclosureAn organization may disclose an individual’s personal information without their knowledge or consent if the disclosure is reasonably made to another organization for a purpose related to investigating a breach of an agreement or a contravention of federal or provincial law that has been, is being or is about to be committed and it is reasonable to expect that disclosure with the individual’s knowledge or consent would compromise the investigation.
Use for investigationsAn organization may use an individual’s personal information without their knowledge or consent if, in the course of its activities, the organization becomes aware of information that it has reasonable grounds to believe could be useful in the investigation of a contravention of federal or provincial law or a law of a foreign jurisdiction that has been, is being or is about to be committed and the information is used for the purpose of investigating that contravention.
Breach of security safeguardsAn organization may disclose an individual’s personal information without their knowledge or consent ifthe disclosure is made to the other organization, government institution or part of a government institution that was notified of a breach under subsection 59(1); andthe disclosure is made solely for the purpose of reducing the risk of harm to the individual that could result from the breach or mitigating that harm.
Proceeds of Crime (Money Laundering) and Terrorist Financing ActAn organization may disclose an individual’s personal information without their knowledge or consent to another organization under subsection 11.01(1) of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act.CollectionAn organization may collect an individual’s personal information without their knowledge or consent if the personal information is disclosed to it under subsection (1).UseAn organization may use an individual’s personal information without their knowledge or consent if it was collected under subsection (2).
Disclosures to Government Institutions
Administering law — request of government institutionAn organization may disclose an individual’s personal information without their knowledge or consent to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that the disclosure is requested for the purpose of administering federal or provincial law.
Law enforcement — request of government institutionAn organization may disclose an individual’s personal information without their knowledge or consent to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that the disclosure is requested for the purpose of enforcing federal or provincial law or the law of a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law.
Contravention of law — initiative of organizationAn organization may on its own initiative disclose an individual’s personal information without their knowledge or consent to a government institution or a part of a government institution if the organization has reasonable grounds to believe that the information relates to a contravention of federal or provincial law or the law of a foreign jurisdiction that has been, is being or is about to be committed.
Proceeds of Crime (Money Laundering) and Terrorist Financing ActAn organization may disclose an individual’s personal information without their knowledge or consent to the government institution referred to in section 7 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act as required by that section.
National security, defence or international affairs — request by government institutionAn organization may disclose an individual’s personal information without their knowledge or consent to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs.CollectionAn organization may collect an individual’s personal information without their knowledge or consent for the purpose of making a disclosure under subsection (1).UseAn organization may use an individual’s personal information without their knowledge or consent if it was collected under subsection (2).
National security, defence or international affairs — initiative of organizationAn organization may on its own initiative disclose an individual’s personal information without their knowledge or consent to a government institution or a part of a government institution if the organization suspects that the information relates to national security, the defence of Canada or the conduct of international affairs.CollectionAn organization may collect an individual’s personal information without their knowledge or consent for the purpose of making a disclosure under subsection (1).UseAn organization may use an individual’s personal information without their knowledge or consent if it was collected under subsection (2).
Required by Law
Required by law — collectionAn organization may collect an individual’s personal information without their knowledge or consent for the purpose of making a disclosure that is required by law.UseAn organization may use an individual’s personal information without their knowledge or consent if it was collected under subsection (1).DisclosureAn organization may disclose an individual’s personal information without their knowledge or consent if the disclosure is required by law.
Subpoena, warrant or orderAn organization may disclose an individual’s personal information without their knowledge or consent if the disclosure is required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of procedure relating to the production of records.
Publicly Available Information
Information specified by regulationsAn organization may collect, use or disclose an individual’s personal information without their knowledge or consent if the personal information is publicly available and is specified by the regulations.
Non-application of Certain Exceptions — Electronic Addresses and Computer Systems
DefinitionsThe following definitions apply in this section.access means to program, execute programs on, communicate with, store data in, retrieve data from or otherwise make use of any resources, including data or programs of a computer system or a computer network. (utiliser)computer program has the same meaning as in subsection 342.1(2) of the Criminal Code. (programme d’ordinateur)computer system has the same meaning as in subsection 342.1(2) of the Criminal Code. (ordinateur)electronic address means an address used in connection withan electronic mail account;an instant messaging account; orany similar account. (adresse électronique)Collection and use of electronic addressesAn organization is not authorized under section 18, 23 or 26, subsection 29(1) or section 30, 37, 39 or 50 tocollect an individual’s electronic address without their knowledge or consent, if the address is collected by the use of a computer program that is designed or marketed primarily for use in generating or searching for, and collecting, electronic addresses; oruse an individual’s electronic address without their knowledge or consent, if the address is collected by the use of a computer program described in paragraph (a).Collection and use of personal informationAn organization is not authorized under section 18, 23 or 26, subsection 29(1), section 30 or 37, subsection 38(1) or section 39 or 50 tocollect an individual’s personal information without their knowledge or consent, through any means of telecommunication, if the information is collected by accessing a computer system or causing a computer system to be accessed in contravention of an Act of Parliament; oruse an individual’s personal information without their knowledge or consent, if the information is collected in a manner described in paragraph (a).Express consentDespite subsection 15(5), an organization is not to rely on an individual’s implied consent in respect of any collection of personal information described in paragraph (2)(a) or (3)(a) or any use of personal information described in paragraph (2)(b) or (3)(b).
Retention and Disposal of Personal Information
Period for retention and disposalAn organization must not retain personal information for a period longer than necessary tofulfill the purposes for which the information was collected, used or disclosed; orcomply with the requirements of this Act, of federal or provincial law or of the reasonable terms of a contract.The organization must dispose of the information as soon as feasible after that period.Sensitivity of personal informationFor the purposes of paragraph (1)(a), when determining the retention period, the organization must take into account the sensitivity of the information.
Personal information used for decision-makingAn organization that uses personal information to make a decision about an individual must retain the information for a sufficient period of time to permit the individual to make a request for access under section 63.
Disposal at individual’s requestIf an organization receives a written request from an individual to dispose of their personal information that is under the organization’s control, the organization must, as soon as feasible, dispose of the information, ifthe information was collected, used or disclosed in contravention of this Act;the individual has withdrawn their consent, in whole or in part, to the collection, use or disclosure of the information; orthe information is no longer necessary for the continued provision of a product or service requested by the individual.ExceptionAn organization may refuse a request to dispose of personal information in the circumstances described in paragraph (1)(b) or (c) ifthe disposal of the information would result in the disposal of personal information about another individual and the information cannot be severed without imposing an undue burden on the organization;there are other requirements of this Act, of federal or provincial law or of the reasonable terms of a contract that prevent it from disposing of the information;the information is necessary for the establishment of a legal defence or in the exercise of other legal remedies by the organization;the information is not in relation to a child and the disposal of the information would have an undue adverse effect on the accuracy or integrity of information that is necessary to the ongoing provision of a product or service to the individual in question;the request is vexatious or made in bad faith; orthe disposal of the information would have an undue adverse effect on the organization that outweighs any potential adverse effect on the individual resulting from the retention of the information.ExceptionAn organization is not required to dispose of de-identified personal information.Reasons for refusalAn organization that refuses to dispose of an individual’s personal information mustinform them in writing of the refusal, setting out the reasons and any recourse that they may have under section 73 or subsection 97(1); andin the case of a request that is refused under paragraph (2)(f), inform the Commission in writing of the refusal, setting out the reasons.Disposal of transferred personal informationIf an organization disposes of personal information at an individual’s request, it must, as soon as feasible, inform any service provider to which it has transferred the information of the request and ensure that the service provider disposes of the information.
Accuracy of Personal Information
Accuracy of informationAn organization must take reasonable steps to ensure that personal information under its control is as accurate, up to date and complete as is necessary to fulfill the purposes for which the information is collected, used or disclosed.ExceptionAn organization is not required to take the steps referred to in subsection (1) in respect of de-identified personal information.Extent of accuracyIn determining the extent to which personal information must be accurate, complete and up to date, the organization must take into account the individual’s interests, includingwhether the information may be used to make a decision about the individual;whether the information is used on an ongoing basis; andwhether the information is disclosed to third parties.Routine updatingAn organization is not to routinely update personal information unless it is necessary to fulfill the purposes for which the information is collected, used or disclosed.
Security Safeguards
Security safeguardsAn organization must protect personal information through physical, organizational and technological security safeguards. The level of protection provided by those safeguards must be proportionate to the sensitivity of the information.Factors to take into accountIn addition to the sensitivity of the information, the organization must, in establishing its security safeguards, take into account the quantity, distribution, format and method of storage of the information, as well as any reasonably foreseeable privacy implications that may arise in relation to the transfer of personal information to a service provider.Scope of security safeguardsThe security safeguards must protect personal information against, among other things, loss, theft or unauthorized access, disclosure, copying, use or modification and must include reasonable measures to authenticate the identity of the individual to whom the personal information relates.
Disclosure or transfer outside of CanadaBefore disclosing or transferring personal information outside of Canada, an organization mustcarry out, in accordance with the prescribed requirements, a privacy impact assessment; andimplement measures to mitigate the risks identified in the privacy impact assessment, such as contractual privacy protection measures, adherence to a code of practice or certification process approved by the Division or any other prescribed measures.Provision to CommissionAn organization must, on request, provide the Commission with access to, or a copy of, the assessment.
Report to CommissionAn organization must report to the Commission any breach of security safeguards involving personal information under the organization’s control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.Report requirementsThe report must contain the prescribed information and must be made in the prescribed form and manner as soon as feasible after the organization determines that the breach has occurred.Notification to individualUnless otherwise prohibited by law, an organization must notify an individual of any breach of security safeguards involving the individual’s personal information under the organization’s control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.Contents of notificationThe notification must contain sufficient information to allow the individual to understand the significance to them of the breach and to take steps, if any are possible, to reduce the risk of harm that could result from it or to mitigate that harm. It must also contain any other prescribed information.Form and mannerThe notification must be conspicuous and must be given directly to the individual in the prescribed form and manner, except in prescribed circumstances, in which case it must be given indirectly in the prescribed form and manner.Time to give notificationThe notification must be given as soon as feasible after the organization determines that the breach has occurred.Definition of significant harmFor the purposes of this section, significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.Real risk of significant harm — factorsThe factors that are relevant to determining whether a breach of security safeguards creates a real risk of significant harm to the individual includethe sensitivity of the personal information involved in the breach;the probability that the personal information has been, is being or will be misused; andany other prescribed factor.
Notification to organizationsAn organization that notifies an individual of a breach of security safeguards under subsection 58(3) must notify any other organization, a government institution or a part of a government institution of the breach if the notifying organization believes that the other organization or the government institution or part concerned may be able to reduce the risk of harm that could result from it or mitigate that harm, or if any of the prescribed conditions are satisfied.Time to give notificationThe notification must be given as soon as feasible after the organization determines that the breach has occurred.
RecordsAn organization must, in accordance with any prescribed requirements, keep and maintain a record of every breach of security safeguards involving personal information under its control.Provision to CommissionAn organization must, on request, provide the Commission with access to, or a copy of, the record.
Service providersIf a service provider determines that any breach of security safeguards has occurred that involves personal information, it must as soon as feasible notify the organization that controls the personal information.
Openness and Transparency
Policies and practicesAn organization must make readily available, in plain language, information that explains the organization’s policies and practices put in place to fulfill its obligations under this Act.Required informationIn fulfilling its obligation under subsection (1), an organization must make the following information available:a description of the type of personal information under the organization’s control;a general account of how the organization uses the personal information and of how it applies the exceptions to the requirement to obtain an individual’s consent under this Act, including a description of any activities referred to in subsection 18(3) in which it has a legitimate interest;a general account of the organization’s use of any automated decision system to make predictions, recommendations or decisions about individuals that could have a legal or similarly significant effect on them;whether or not the organization transfers or discloses personal information interprovincially or outside of Canada that may have reasonably foreseeable privacy implications;the retention periods applicable to sensitive personal information;how an individual may make a request for disposal under section 54 or access under section 63; andthe business contact information of the individual to whom complaints or requests for information may be made.
Access to and Amendment of Personal Information
Information and accessOn request by an individual, an organization must inform them of whether it has any personal information about them, how it uses the information and whether it has disclosed the information. It must also give the individual access to the information.ExceptionAn organization is not required to act on a request in respect of de-identified personal information.Names or types of third partiesIf the organization has disclosed the information, the organization must also provide to the individual the names of the third parties or types of third parties to which the disclosure was made, including in cases where the disclosure was made without the consent of the individual.Automated decision systemIf the organization has used an automated decision system to make a prediction, recommendation or decision about the individual that could have a legal or similarly significant effect on them, the organization must, on request by the individual, provide them with an explanation of the prediction, recommendation or decision.ExplanationThe explanation must indicate the type of personal information that was used to make the prediction, recommendation or decision, the source of the information and the reasons or principal factors that led to the prediction, recommendation or decision.RepresentationsThe organization must provide an individual with an opportunity to make written representations to an employee of the organization who is able to review the prediction, recommendation or decision that was made about them.
Request in writingA request made under section 63 must be made in writing.AssistanceAn organization must assist any individual who informs the organization that they need assistance in preparing a request to the organization.
Information to be providedAn organization may require the individual to provide it with sufficient information to allow the organization to fulfill its obligations under section 63.
Plain languageThe information referred to in section 63 must be provided to the individual in plain language.Sensory disabilityFor the purposes of section 63, an organization must give access to personal information in an alternative format to an individual with a sensory disability who requests that it be transmitted in that format ifa version of the information already exists in that format; orits conversion into that format is reasonable and necessary in order for the individual to be able to exercise their rights under this Act.Sensitive medical informationAn organization may choose to give an individual access to sensitive medical information through a medical practitioner.
Time limitAn organization must respond to a request made under section 63 with due diligence and no later than 30 days after the day on which the request is received.Extension of time limitAn organization may extend the time limit referred to in subsection (1)for a maximum of 30 days ifmeeting the time limit would unreasonably interfere with the activities of the organization, orthe time required to undertake any consultations necessary to respond to the request would make the time limit impracticable to meet; orfor the period that is necessary in order to be able to convert the personal information into an alternative format.In either case, the organization must, no later than 30 days after the day on which the request was received, send a notice of extension to the individual, advising them of the new time limit, the reasons for extending the time limit and their right to make a complaint to the Commissioner in respect of the extension.ReasonsAn organization that responds within the time limit and refuses a request must inform the individual in writing of the refusal, setting out the reasons and any recourse that they may have under section 73 or subsection 97(1).Deemed refusalIf the organization fails to respond within the time limit, the organization is deemed to have refused the request.
Costs for respondingAn organization must not respond to an individual’s request made under section 63 at a cost unlessthe organization has informed the individual of the approximate cost;the cost to the individual is minimal; andthe individual has advised the organization that the request is not being withdrawn.
Retention of informationAn organization that has personal information that is the subject of a request made under section 63 must retain the information for as long as is necessary to allow the individual to exhaust any recourse that they may have under this Act.
When access prohibitedDespite section 63, an organization must not give an individual access to personal information under that section if doing so would likely reveal personal information about another individual. However, if the information about the other individual is severable from the information about the requester without imposing an undue burden on the organization, the organization must sever the information about the other individual before giving the requester access.LimitSubsection (1) does not apply if the other individual consents to the access or the requester needs the information because an individual’s life, health or security is threatened.Information related to certain exceptions to consentAn organization must comply with subsection (4) if an individual requests that the organizationinform the individual aboutany disclosure to a government institution or a part of a government institution under section 43, 44 or 45, subsection 46(1) or 47(1) or section 49, orthe existence of any information that the organization has relating to a disclosure referred to in subparagraph (i), to a subpoena, warrant or order referred to in section 49 or to a request made by a government institution or a part of a government institution under section 43 or subsection 46(1); orgive the individual access to the information referred to in subparagraph (a)(ii).Notification and responseAn organization to which subsection (3) appliesmust, in writing and without delay, notify the government institution or the part of a government institution concerned of the request made by the individual; andmust not respond to the request before the earlier ofthe day on which it is notified under subsection (5), and30 days after the day on which the government institution or the part of a government institution is notified.ObjectionWithin 30 days after the day on which it is notified under subsection (4), the government institution or part of a government institution must notify the organization as to whether the institution or part objects to the organization complying with the request. The institution or part of an institution may object only if the institution or part is of the opinion that compliance with the request could reasonably be expected to be injurious tonational security, the defence of Canada or the conduct of international affairs;the detection, prevention or deterrence of money laundering or the financing of terrorist activities; orthe enforcement of federal or provincial law or law of a foreign jurisdiction, an investigation relating to the enforcement of any such law or the gathering of intelligence for the purpose of enforcing any such law.ProhibitionDespite section 63, if an organization is notified under subsection (5) that the government institution or part of a government institution objects to the organization complying with the request, the organizationmust refuse the request to the extent that it relates to paragraph (3)(a) or to information referred to in subparagraph (3)(a)(ii);must notify the Commission, in writing and without delay, of the refusal;must not give the individual access to any information that the organization has relating to a disclosure to a government institution or a part of a government institution under section 43, 44 or 45, subsection 46(1) or 47(1) or section 49 or to a request made by a government institution or part of a government institution under section 43 or subsection 46(1);must not provide to the individual the name of the government institution or part of a government institution to which the disclosure was made or its type; andmust not disclose to the individual the fact that the organization notified an institution or part of an institution under paragraph (4)(a), that the institution or part of an institution objects or that the Commission was notified under paragraph (b).When access may be refusedDespite section 63, an organization is not required to give access to personal information ifthe information is protected by solicitor-client privilege or the professional secrecy of advocates and notaries or by litigation privilege;to do so would reveal confidential commercial information;to do so could reasonably be expected to threaten the life or security of another individual;the information was collected under subsection 38(1);the information was generated in the course of a formal dispute resolution process; orthe information was created for the purpose of making a disclosure under the Public Servants Disclosure Protection Act or in the course of an investigation into a disclosure under that Act.However, in the circumstances described in paragraph (b) or (c), if giving access to the information would reveal confidential commercial information or could reasonably be expected to threaten the life or security of another individual, as the case may be, and that information is severable from any other information for which access is requested without imposing an undue burden on the organization, the organization must give the individual access after severing.LimitSubsection (7) does not apply if the individual needs the information because an individual’s life, health or security is threatened.NoticeIf an organization decides not to give access to personal information in the circumstances set out in paragraph (7)(d), the organization must, in writing, notify the Commission, and must provide any information that the Commission may specify.
Amendment of personal informationIf an individual has been given access to their personal information and demonstrates that the information is not accurate, up to date or complete, the organization must amend the information as required.ExceptionAn organization is not required to amend de-identified personal information.Third partyThe organization must, if it is appropriate to do so, transmit the amended information to any third party that has access to the information.Record of determinationIf the organization and the individual do not agree on the amendments that are to be made to the information, the organization must record the disagreement and, if it is appropriate to do so, inform third parties that have access to the information of the fact that there is a disagreement.
Mobility of Personal Information
Data mobility frameworkSubject to the regulations, on the request of an individual, an organization must as soon as feasible disclose the personal information that it has collected from the individual to an organization designated by the individual, if both organizations are subject to a data mobility framework.ExceptionAn organization is not required to disclose de-identified personal information.
Challenging Compliance
Complaints and requests for informationAn individual may make a complaint, or a request for information, to an organization with respect to its compliance with this Part. The organization must respond to any complaint or request that it receives.Process for making complaint or requestAn organization must make readily available information about the process for making a complaint or request.Investigation of complaintsAn organization must investigate any complaint that it receives and make any necessary changes to its policies, practices and procedures as a result of the investigation.
De-identification of Personal Information
Proportionality of technical and administrative measuresAn organization that de-identifies personal information mustconsider, when applying technical and administrative measures to the information, the risk of an individual being identified; andensure that those measures are proportionate to the purpose for which the information is de-identified and the sensitivity of the personal information.
ProhibitionAn organization must not use de-identified personal information, alone or in combination with other information, to identify an individual exceptto conduct testing of the effectiveness of security safeguards that it has put in place;in circumstances where the personal information was de-identified solely for the purpose of protecting the information;in circumstances where the organization obtains the individual’s valid consent;in circumstances where an exception in respect of the use of an individual’s personal information set out in section 18, 23, 24 or 26, subsection 27(2) or 29(2), section 30, subsection 38(2) or section 50 applies;in circumstances where the personal information is used solely for the purpose of anonymizing it under section 20;to comply with any requirements under this Act or under federal or provincial law;to conduct testing of the fairness and accuracy of models, processes and systems that were developed using de-identified personal information;to conduct testing of the effectiveness of its de-identification processes;for a purpose or situation authorized by the Division under section 138; andin any other prescribed circumstances.
Commission, Commissioner and DivisionCommission
Powers, duties and functionsFor the purposes of this Act, the Commission maydisclose to the Commissioner of Competition, under an agreement or arrangement entered into under section 80, information that relates to an entity that operates an approved certification program or an organization that is certified under an approved certification program;consult with federal government institutions respecting codes of practice or certification programs; andin the form and manner that the Commission considers appropriate,develop and conduct information programs to foster public understanding of this Act and its purposes,develop guidance materials and tools for organizations in relation to their compliance with this Act — including any guidance materials and tools that are requested by the Minister — in consultation with stakeholders, including any relevant federal government institutions,undertake and publish research in relation to the protection of personal information, including any research that is requested by the Minister,undertake and publish any research in relation to the operation or implementation of this Act that is requested by the Minister,on request by an organization, provide guidance on — and, if the Commission considers it appropriate, recommend corrective measures in relation to — its privacy management program, andpromote, by any other means that the Commission considers appropriate, the purpose of this Act.
Factors to take into accountIn exercising any powers or performing any duties or functions under this Act, the Commission must take into account all relevant factors, including, if applicable,the purpose of this Act;the size and revenue of organizations;the volume of the personal information under the control of organizations and the sensitivity of that information;the best interests of children;the importance of respecting Canada’s international trade obligations;the importance of supporting economic growth, competition and innovation in the Canadian marketplace; andany other matter of general public interest.
Information — powers, duties or functionsThe Commission must make readily available information on the manner in which it, the Commissioner and the Division exercise their powers and perform their duties and functions under this Act.Guidance materialThe Commission must develop, in consultation with the Minister and stakeholders, guidance material respecting the exercise or performance of the powers, duties and functions of the Commission, the Commissioner and the Division in relation to enforcement and dispute resolution under this Act, including in respect ofthe decision to initiate a complaint under subsection 97(2);the handling of complaints, including the decision as to whether to initiate or discontinue an investigation and the conduct of proceedings in respect of an application referred to in section 109 or an interim order referred to in subsection 123(4);the dispute resolution mechanisms referred to in section 101;the compliance agreements referred to in section 102 and 103;the proposed orders referred to in subsections 107(3) and 108(3) and compliance orders referred to in subsection 110(1);the administrative monetary penalty scheme; andthe audits referred to in section 118.Availability of materialThe Commission must make the guidance material available in a form and manner that it considers appropriate.
Agreements or arrangements — MinisterThe Commission may enter into an agreement or arrangement with the Minister that relates to the administration of this Act.
Agreements or arrangements — CRTC, Commissioner of Competition, etc.The Commission may enter into agreements or arrangements with the Canadian Radio-television and Telecommunications Commission, the Commissioner of Competition or any other prescribed entity in order tocoordinate the activities of their respective offices, including providing for mechanisms for handling complaints of mutual interest;undertake and publish research on issues of mutual interest; anddevelop procedures for disclosing information referred to in subsection (2).The Commission must, if the Commission considers it appropriate to do so, carry out those objectives in a manner that promotes regulatory consistency.Disclosure of informationThe Commission may, in accordance with any procedure developed under paragraph (1)(c), disclose information, other than information that it has received under subsection 10(1) or subparagraph 76(c)(v), to the Canadian Radio-television and Telecommunications Commission, the Commissioner of Competition or a prescribed entity referred to in subsection (1) if the information is relevant to their powers, duties or functions.Purpose and confidentialityThe procedures referred to in paragraph (1)(c) mustrestrict the use of the information to the purpose for which it was originally disclosed; andstipulate that the information be treated in a confidential manner and that it not be further disclosed without the express consent of the Commission.
Consultations with provincesIf the Commission considers it appropriate to do so, or on request by an interested person, the Commission may, in order to ensure that personal information is protected in as consistent a manner as possible, consult with any person who, under provincial legislation, has powers, duties and functions similar to its own, to those of the Commissioner or to those of the Division with respect to the protection of personal information.Agreements or arrangements with provincesThe Commission may enter into agreements or arrangements with any person referred to in subsection (1) in order tocoordinate the activities of their respective offices, including providing for mechanisms for handling complaints in which they are mutually interested;undertake and publish research, or develop and publish guidelines or other documents, related to the protection of personal information;develop model contracts or other documents related to the protection of personal information that is collected, used or disclosed interprovincially or internationally; anddevelop procedures for disclosing information referred to in subsection (3).Disclosure of information to provincesThe Commission may, in accordance with any procedure developed under paragraph (2)(d), disclose information, other than information that it has received under subsection 10(1) or subparagraph 76(c)(v), to any person referred to in subsection (1) if the informationcould be relevant to the — ongoing or potential — investigation of a complaint, proceeding in respect of an application referred to in section 109, proceeding in respect of an interim order referred to in subsection 123(4) or audit carried out under this Act or provincial legislation that has objectives that are similar to this Act; orcould assist that person, the Commission, the Commissioner or the Division in the exercise of their powers or the performance of their duties or functions with respect to the protection of personal information.Purpose and confidentialityThe procedures referred to in paragraph (2)(d) mustrestrict the use of the information to the purpose for which it was originally disclosed; andstipulate that the information be treated in a confidential manner and that it not be further disclosed without the express consent of the Commission.
Disclosure of information to foreign stateSubject to subsection (3), the Commission may, in accordance with any procedure developed under paragraph (4)(b), disclose information referred to in subsection (2), other than information that it has received under subsection 10(1) or subparagraph 76(c)(v), to any person or body that, under the legislation of a foreign state, haspowers, duties and functions similar to those of the Commission, Commissioner or Division with respect to the protection of personal information; orresponsibilities that relate to conduct that is substantially similar to conduct that would be in contravention of this Act.Information that can be disclosedThe Commission is authorized to disclose information that it believescould be relevant to an — ongoing or potential — investigation or proceeding in respect of a contravention of the laws of a foreign state that address conduct that is substantially similar to conduct that would be in contravention of this Act; oris necessary to disclose in order to obtain from the person or body information that could be relevant to an — ongoing or potential — investigation, proceeding in respect of an application referred to in section 109, proceeding in respect of an interim order referred to in subsection 123(4) or audit carried out under this Act.Written arrangementsThe Commission may only disclose information to the person or body if the Commission has entered into a written arrangement with the person or body thatlimits the disclosure of information to what is necessary for the purpose set out in paragraph (2)(a) or (b);restricts the use of the information to the purpose for which it was originally disclosed; andstipulates that the information be treated in a confidential manner and that it not be further disclosed without the express consent of the Commission.ArrangementsThe Commission may enter into arrangements with one or more persons or bodies referred to in subsection (1) in order toprovide for cooperation with respect to the enforcement of laws protecting personal information, including the disclosure of information referred to in subsection (2) and the provision of mechanisms for handling complaints of mutual interest;develop procedures for disclosing information referred to in subsection (2);develop recommendations, resolutions, rules, standards or other documents with respect to the protection of personal information;undertake and publish research related to the protection of personal information;share knowledge and expertise by different means, including through staff exchanges; andidentify issues of mutual interest and determine priorities pertaining to the protection of personal information.
Annual reportThe Commission must include in the report referred to in subsection 21(1) of the Digital Safety and Data Protection Commission of Canada Act information in respect of:the exercise of the powers, and the performance of the duties and functions, of the Commission, the Commissioner and the Division under this Act, including in relation to paragraph 76(c), section 77, subsections 78(2) and 80(1) and sections 86 and 90;the application of this Act; andthe extent to which the provinces have enacted legislation that is substantially similar to this Act and the application of any such legislation.ConsultationThe Commission must consult with persons in the provinces who it believes are in a position to assist it in making a report on personal information that is collected, used or disclosed interprovincially or internationally.
DelegationThe Commission may delegate, subject to any terms and conditions that it may specify, to any of its members, the Division or a division of the Commission established under section 8 of the Digital Safety and Data Protection Commission of Canada Act any of the powers, duties and functions conferred on it under this Act or the Digital Safety and Data Protection Commission of Canada Act, to the extent that those powers are exercised and those duties and functions are performed in connection with powers, duties and functions under this Act.Limitation — procedures and practicesThe Commission must not delegate its power referred to in section 9 of the Digital Safety and Data Protection Commission of Canada Act to establish rules respecting its procedures and practices in connection with matters to which this Act applies, except to the Commissioner or to the Division.Limitation — decisionThe Commission must not delegate the powers, duties and functions referred to in subsection 110(1), 121(1) or 123(4), except to a division of the Commission established under section 8 of the Digital Safety and Data Protection Commission of Canada Act or one or more members of the Commission other than the Commissioner.Certificate of delegationAny person to whom powers, duties or functions are delegated must be given a certificate of the delegation and the delegate must produce the certificate, on request, to the person in charge of any premises to be entered under paragraph 121(2)(e).
Commissioner
DesignationThe Governor in Council must designate one of the members of the Commission, other than the Chairperson, to be the Privacy and Consumer Data Commissioner.Powers, duties and functionsThe Commissioner mayrequest that an entity that operates an approved certification program provide the Commissioner with information that relates to the program;cooperate with an entity that operates an approved certification program for the purpose of the exercise of the Commissioner’s powers, and the performance of their duties and functions, under this Act;in the circumstances and according to the criteria set out in the regulations, recommend, in accordance with the regulations, to an entity that operates an approved certification program that an organization’s certification be withdrawn if the Commissioner is of the opinion that the organization is not in compliance with the requirements of the program; andin accordance with the regulations, revoke an approval of a certification program in the circumstances and according to the criteria set out in the regulations.Acting CommissionerIf the Commissioner is absent or incapacitated or if their office is vacant, the Chairperson may authorize another member of the Commission to act as Commissioner. The member is not, however, authorized to act as Commissioner for a period of more than 90 days without the approval of the Governor in Council.
Factors to take into accountIn exercising any powers or performing any duties or functions under this Act, the Commissioner must take into account all relevant factors, including, if applicable,the purpose of this Act;the size and revenue of organizations;the volume of the personal information under the control of organizations and the sensitivity of that information;the best interests of children;the importance of respecting Canada’s international trade obligations;the importance of supporting economic growth, competition and innovation in the Canadian marketplace; andany other matter of general public interest.
Prohibition — use for initiating complaint or auditThe Commissioner must not use the information that the Commission receives under subsection 10(1) or subparagraph 76(c)(v) as grounds to initiate a complaint under subsection 97(2) or to carry out an audit under section 118, unless the Commissioner considers that the organization has wilfully disregarded the corrective measures that were recommended in relation to its privacy management program.
DelegationThe Commissioner may delegate, subject to any terms and conditions that they may specify, any of the powers, duties and functions conferred on them, other than those referred to in subsection 105(1), section 106 and paragraph 122(1)(d),to any employee of the Commission; andwith the consent of the Chairperson, to the Division, a division of the Commission established under section 8 of the Digital Safety and Data Protection Commission of Canada Act or one or more other members of the Commission.Certificate of delegationAny person to whom powers, duties or functions set out in paragraphs 122(1)(a) to (c) and (e) to (h) are delegated must be given a certificate of the delegation and the delegate must produce the certificate, on request, to the person in charge of any premises to be entered under paragraph (f) of that subsection.
Division
Division establishedThe Privacy and Consumer Data Division is established and composed of the Commissioner and at least one other member of the Commission assigned by the Commission.Other powers, duties and functionsThe members who compose the Division, other than the Commissioner, may continue to exercise any power and perform any duty or function that they are authorized to exercise or perform under any other Act of Parliament.
Factors to take into accountIn exercising any powers or performing any duties or functions under this Act, the Division must take into account all relevant factors, including, if applicable,the purpose of this Act;the size and revenue of organizations;the volume and sensitivity of the personal information under the control of organizations;the best interests of children;the importance of respecting Canada’s international trade obligations;the importance of supporting economic growth, competition and innovation in the Canadian marketplace; andany other matter of general public interest.
DelegationThe Division may delegate to one or more members of the Commission, or to any of its employees, any of the powers, duties and functions conferred on the Division, subject to any terms and conditions that it may specify.LimitationThe Division must not delegate, without the consent of the Chairperson, any of its powers, duties or functions to a member of the Commission who has not been assigned to the Division.
Codes of Practice and Certification Programs
Definition of entityIn this section and sections 93 to 96, entity includes any organization, regardless of whether it is an organization to which this Act applies, or a government institution.Code of practiceAn entity may, in accordance with the regulations, apply to the Division for approval of a code of practice that provides for substantially the same or greater protection of personal information as some or all of the protection provided under this Act.Approval by DivisionThe Division may approve the code of practice if the Division determines that the code meets the criteria set out in the regulations.
Certification programAn entity may, in accordance with the regulations, apply to the Division for approval of a certification program that includesa code of practice that provides for substantially the same or greater protection of personal information as some or all of the protection provided under this Act;guidelines for interpreting and implementing the code of practice;a mechanism by which an entity that operates the program may certify that an organization is in compliance with the code of practice;a mechanism for the independent verification of an organization’s compliance with the code of practice;disciplinary measures for non-compliance with the code of practice by an organization, including the revocation of an organization’s certification; andanything else that is provided in the regulations.Approval by DivisionThe Division may approve the certification program if the Division determines that the program meets the criteria set out in the regulations.
Response by DivisionThe Division must respond in writing to an application under subsection 92(2) or 93(1) in the time specified in the regulations.
Approval made publicThe Division must make public a decision to approve a code of practice or certification program.
For greater certaintyFor greater certainty, compliance with the requirements of a code of practice or a certification program does not relieve an organization of its obligations under this Act.
RemediesFiling of Complaints
ContraventionAn individual may file with the Commissioner a written complaint against an organization for contravening Part 1.Commissioner may initiate complaintIf the Commissioner is satisfied that there are reasonable grounds to investigate a matter under this Act, the Commissioner may initiate a complaint in respect of the matter.Time limitA complaint that results from the refusal to grant a request made under section 63 must be filed within six months, or any longer period that the Commissioner allows, after the refusal or after the expiry of the time limit for responding to the request, as the case may be.NoticeThe Commissioner must give notice of a complaint to the organization against which the complaint was made, unless the Commissioner decides under section 99 not to carry out an investigation.
Investigation of Complaints and Dispute Resolution
Investigation of complaint by CommissionerThe Commissioner must carry out an investigation in respect of a complaint, unless the Commissioner is of the opinion thatthe complainant should first exhaust grievance or review procedures otherwise reasonably available;the complaint could more appropriately be dealt with, initially or completely, by means of a procedure provided for under any federal law, other than this Act, or provincial law;the complaint was not filed within a reasonable period after the day on which the subject matter of the complaint arose;the complaint raises an issue in respect of which a certification program that was approved by the Division under subsection 93(2) applies and the organization is certified under that program;there is insufficient evidence to pursue the investigation;the complaint is trivial, frivolous or vexatious or is made in bad faith;the organization has provided a fair and reasonable response to the complaint;the matter is already the subject of an ongoing investigation under this Act or proceeding in respect of an application referred to in section 109 or interim order referred to in subsection 123(4);the matter has already been the subject of a report or decision by the Commission or Commissioner, as the case may be;the matter is being or has already been addressed under a procedure referred to in paragraph (a) or (b);the matter is the subject of a compliance agreement referred to in subsection 102(1) or 103(2);an investigation or any further investigation is unnecessary having regard to all the circumstances of the complaint; ora notice of contravention was served on the organization in relation to the matter or to any act referred to in the complaint.NotificationThe Commissioner must notify the complainant and the organization of the Commissioner’s decision not to investigate the complaint or any act referred to in the complaint and give reasons for the decision. However, if the decision is made for any of the reasons set out in section 99, the Commissioner must not notify the organization.Compelling reasonsThe Commissioner may reconsider a decision not to investigate under subsection (1) if the Commissioner is satisfied that the complainant has established that there are compelling reasons to investigate.
ExceptionDespite subsection 98(1), the Commissioner is not required to carry out an investigation in respect of an act referred to in a complaint if the Commissioner is of the opinion that the act, if proved, would constitute a contravention of any of sections 6 to 9 of An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act or section 52.01 of the Competition Act or would constitute conduct that is reviewable under section 74.011 of that Act.
DiscontinuanceThe Commissioner may discontinue the investigation of a complaint if the Commissioner has formed an opinion referred to in subsection 98(1) or section 99. The Commissioner must notify the complainant and the organization of the discontinuance and give reasons for the decision.ExceptionIf the decision is made for any of the reasons set out in section 99, the Commissioner must not notify the organization.
Dispute resolution mechanismsThe Division may attempt to resolve a complaint by means of a dispute resolution mechanism such as mediation and conciliation, unless the complaint is the subject of proceedings in respect of an application referred to in section 109.
Compliance Agreements
Entering into compliance agreementIf, at any time after an investigation has been commenced, the Commissioner believes on reasonable grounds that an organization has committed, is about to commit or is likely to commit an act or omission that could constitute a contravention of Part 1, the Commissioner may enter into, with that organization, a compliance agreement aimed at ensuring compliance with this Act.TermsA compliance agreement may contain any terms that the Commissioner considers necessary to ensure compliance with this Act.Effect of compliance agreementThe Commissioner must not issue a notice of contravention in respect of any matter covered under the agreement.For greater certaintyFor greater certainty, entering into a compliance agreement does not preclude the prosecution of an offence under this Act.
Effect of compliance agreementIf, after a notice of contravention has been served under subsection 105(1), the Commissioner initiates negotiations to enter into a compliance agreement with the organization, the Commission must suspend proceedings in respect of the contravention in relation to the act or omission that is the subject of the negotiations and notify the complainant and the organization without delay.Termination of proceedingsIf a compliance agreement is entered into with the organization, the Commission must terminate the proceedings commenced in respect of the contravention in relation to the act or omission that is the subject of agreement and notify the complainant and the organization without delay.Resumption of proceedingsIf the Commissioner and the organization fail to enter into a compliance agreement, the Commission must resume the proceedings and notify the complainant and the organization without delay.
Conclusion of Investigation, Penalties and Orders
Notification and reasonsThe Commissioner must notify the complainant and the organization of their decision and the reasons for it if, after concluding their investigation, they decide not to issue a notice of contravention.
ComplaintAfter investigating a complaint, the Commissioner must cause to be served on the organization a notice of contravention if they have reasonable grounds to believe that the organization has contravened any provision of this Act, and the complaint is not the subject of dispute resolution under section 101 and has not been resolved or discontinued.NoticeThe Commissioner must notify the complainant of their decision.
Compliance agreementIf the Commissioner has reasonable grounds to believe that an organization is not complying with the terms of a compliance agreement entered into under subsection 102(1), they must cause a notice of contravention to be served on the organization.
Notice of contravention — investigation of a complaintA notice of contravention referred to in section 105 must set outthe facts of the alleged contravention and the Commissioner’s reasons for believing there is a contravention;the provisions of this Act that have been contravened;the penalty, if any, that the organization is liable to pay and the time and manner in which the penalty must be paid;the proposed order, if any, that the Commissioner considers reasonably necessary to ensure compliance with this Act and the Commissioner’s reasons for it;a summary of the organization’s rights and obligations under this Act, including the right to apply for a review and to make representations to the Commission under section 109 within 30 days after the day on which the notice is served, or within any further period set out in the notice, and the procedure for doing so;the fact that, if the organization does not pay the penalty, if any, in accordance with the notice or if neither the complainant nor the organization exercise the remedies referred to in section 109, the organization will be deemed to have contravened the provisions at issue; andthe fact that if neither the complainant nor the organization exercise the remedies referred to in section 109 in relation to a proposed order, the organization will be deemed to have contravened the provisions at issue and the proposed order will be made by the Commission.Notice to complainantThe Commissioner must notify the complainant that the notice of contravention was served and that they may apply for a review and make representations to the Commission under section 109 within the period set out in that notice.Proposed order to ensure complianceThe Commissioner may, if they consider it reasonably necessary to ensure compliance with this Act, propose to order the organization totake any measure necessary in order to comply with this Act;cease any act that contravenes this Act; andmake public anything done or planned to be done to correct policies, practices or procedures that it put in place to comply with its obligations under this Act.Payment of the penaltySubject to section 103, if the organization pays the penalty in accordance with the notice of contravention, the organization is deemed to have contravened the provisions of the Act at issue, the proposed order, if any, relating to the provisions in respect of which the penalty was paid is made, as proposed, by the Commission, proceedings in respect of those provisions are ended and the Commission must notify the complainant.PresumptionSubject to section 103, if the organization does not pay the penalty, if any, in accordance with the notice of contravention or if neither the complainant nor the organization exercise the remedies referred to in section 109, the organization is deemed to have contravened the provisions at issue and liable to pay the penalty, if any, set out in the notice and the proposed order, if any, in respect of the contravention is made, as proposed, by the Commission. The Commission must notify the complainant of the deemed contravention.PresumptionSubject to section 103, if neither the complainant nor the organization exercise the remedies referred to in section 109 in relation to a proposed order, the organization is deemed to have contravened the provisions at issue in the order and the proposed order is made, as proposed, by the Commission. The Commission must notify the complainant of the deemed contravention.
Notice of contravention — compliance agreementA notice of contravention referred to in section 106 must set outthe facts of the alleged non-compliance with the compliance agreement and the Commissioner’s reasons for believing there is non-compliance;the provisions of this Act that have been contravened;the penalty, if any, that the organization is liable to pay and the time and manner in which the penalty must be paid;the proposed order, if any, that the Commissioner considers reasonably necessary to ensure compliance with this Act and the Commissioner’s reasons for it;a summary of the organization’s rights and obligations under this Act, including the right to apply for a review and to make representations to the Commission under section 109 within 30 days after the day on which the notice is served, or within any further period set out in the notice, and the procedure for doing so;the fact that, if the organization does not pay the penalty, if any, in accordance with the notice or if neither the complainant nor the organization exercise the remedies referred to in section 109, the organization will be deemed to have contravened the provisions at issue or to have not complied with the compliance agreement; andthe fact that if neither the complainant nor the organization exercise the remedies referred to in section 109 in relation to a proposed order, the organization will be deemed to have contravened the provisions at issue or to have not complied with the compliance agreement and the proposed order will be made by the Commission.Notice to complainantThe Commissioner must notify the complainant that the notice of contravention was served and that they may apply for a review and make representations to the Commission under section 109 within the period set out in that notice.Proposed order to ensure complianceThe Commissioner may, if they consider it reasonably necessary to ensure compliance with this Act, propose to order the organization totake any measure necessary in order to comply with this Act;cease any act that contravenes this Act;comply with the compliance agreement that the organization entered into; andmake public anything done or planned to be done to correct policies, practices or procedures that it put in place to comply with its obligations under this Act.Payment of the penaltyIf the organization pays the penalty in accordance with the notice of contravention, the organization is deemed to have contravened the provisions at issue, the proposed order, if any, relating to the provisions in respect of which the penalty was paid is made, as proposed, by the Commission, proceedings in respect of those provisions are ended and the Commission must notify the complainant.PresumptionIf the organization does not pay the penalty, if any, in accordance with the notice of contravention or if neither the complainant nor the organization exercise the remedies referred to in section 109, the organization is deemed to have contravened the provisions at issue and liable to pay the penalty, if any, set out in the notice and the proposed order, if any, in respect of the contravention is made, as proposed, by the Commission. The Commission must notify the complainant of the deemed contravention.PresumptionIf neither the complainant nor the organization exercise the remedies referred to in section 109 in relation to a proposed order, the organization is deemed to have contravened the provisions at issue and the proposed order is made, as proposed, by the Commission. The Commission must notify the complainant of the deemed contravention.
Application for reviewWithin the period set out in the notice of contravention, the complainant and the organization on which the notice was served may apply for a review of any determination in relation to the elements referred to in paragraphs 107(1)(a) to (d) or 108(1)(a) to (d), as the case may be, and may make representations to the Commission in accordance with the notice.HearingThe Commission may conduct a hearing for the purpose of determining an application and may hold all or any part of the hearing in private.Rules of evidenceThe Commission is not bound by any legal or technical rules of evidence in conducting proceedings under subsection (1) and must deal with the matters set out in the notice as informally and expeditiously as the circumstances and considerations of fairness and natural justice permit.Balance of probabilitiesThe Commission must determine, on a balance of probabilities, whether the organization committed the contravention.
DecisionAfter considering any representations, the Commission may confirm, cancel or vary any determination that is the subject of proceedings under subsection 109(1), may decide whether or not to make the proposed order, if any, and vary its content before making it and may, to the extent it is reasonably necessary to do so in order to ensure compliance with this Act, order the organization totake any measure necessary in order to comply with this Act;cease any act that contravenes this Act;comply with a compliance agreement that the organization entered into; andmake public anything done or planned to be done to correct policies, practices or procedures that it put in place to comply with its obligations under this Act.Contravention not committed — effectIf the Commission decides under subsection (1) that the organization did not commit the contravention, the proceedings in respect of it are ended.Copy of decisionThe Commission must send a copy of the decision and the reasons for it to the complainant and the organization without delay.
Inconsistent interestsIf a member of the Commission who is assigned to hear, or is hearing, an application referred to in section 109, either alone or as a member of a panel, holds any pecuniary or other interest that could be inconsistent with the proper performance of their duties and functions in relation to the application, the member must disclose the interest to the Chairperson without delay. The member must also disclose, without delay, any reason why their participation could result in a reasonable apprehension of bias.Commissioner has no jurisdictionThe Commissioner does not have jurisdiction to hear an application referred to in section 109.For greater certaintyFor greater certainty, a member of the Commission does not lack jurisdiction to hear an application referred to in section 109 by reason only that they participate in the work of the Division.
RulesThe Commission must make rules respecting the conduct of proceedings in respect of an application referred to in section 109, including the rules of evidence to be followed, and must make those rules publicly available.
PenaltyA penalty may only be imposed on an organization in relation to a contravention of one or more of the following provisions:subsection 9(1);subsection 11(1);subsections 12(1), (3) and (4);section 13;subsection 14(1);subsections 15(1) and (7);section 16;subsection 17(2);section 52;subsections 54(1) and (5);subsection 56(1);subsections 58(1) and (3);section 61; andsubsection 62(1).Factors to take into accountIn determining the amount of a penalty, the following factors must be taken into account:the nature and scope of the contravention;any evidence that the organization exercised due diligence to avoid the contravention;whether the organization made reasonable efforts to mitigate or reverse the contravention’s effects;the organization’s history of compliance with this Act;the organization’s ability to pay the penalty and the likely effect that paying it would have on the organization’s ability to carry on its business;any financial benefit that the organization obtained from the contravention;any prescribed factor; andany other relevant factor.LimitationA penalty must not be imposed ifat the time of the contravention of the provision in question, the organization was in compliance with the requirements of a certification program that was in relation to that provision and was approved by the Division under subsection 93(2);a prosecution for the act or omission that constitutes the contravention has been instituted against the organization; orthe organization establishes that it exercised due diligence to prevent the contravention.Receiver GeneralA penalty paid or recovered in relation to a contravention is payable to the Receiver General.
Maximum penaltyThe maximum penalty for all of the contraventions found to have been committed by an organization following the completion of proceedings in relation to any one investigation is the greater of $10,000,000 and 3% of the organization’s gross global revenue in its financial year before the one in which the penalty is imposed.
Purpose of penaltyThe purpose of a penalty is to promote compliance with this Act and not to punish.
Debt due to His MajestyThe following amounts are debts due to His Majesty in right of Canada that are payable and that may be recovered by the Minister in the Federal Court:the amount of any penalty set out in a notice of contravention, beginning on the day on which it is required to be paid in accordance with the notice, unless an application for a review is made under section 109 in the time and manner set out in the notice or a compliance agreement has been entered into under section 103;if an application referred to in paragraph (a) is made,the amount of any penalty set out in the Commission’s decision, beginning on the day on which it is required to be paid in accordance with the decision, if the decision changes the amount of a penalty set out in the notice of contravention, orif the decision does not change any such amount, the amount of any penalty set out in the notice of contravention, beginning on the day specified in the Commission’s decision;if the Commission’s decision is appealed under section 126,the amount of any penalty set out in the decision of the Federal Court, beginning on the day on which it is required to be paid in accordance with that decision, if that decision changes the amount of a penalty set out in the Commission’s decision, orif the decision of the Federal Court does not change any such amount, the amount of any penalty set out in the Commission’s decision, beginning on the day specified in the Court’s decision; andif the decision of the Federal Court is appealed, the amount of the penalty, if any, set out in the final decision after all rights of appeal have been exhausted.Limitation period or prescriptionNo proceedings to recover a debt referred to in subsection (1) may be commenced more than five years after the day on which the debt becomes payable.
Certificate of defaultThe Commission may issue a certificate for the unpaid amount of any debt referred to in section 116.Registration in Federal CourtRegistration of a certificate in the Federal Court has the same effect as a judgment of that Court for a debt of the amount set out in the certificate and all related registration costs.
Audits
Ensure complianceThe Commissioner may, on reasonable notice and at any reasonable time, carry out an audit of the personal information management practices of an organization if the Commissioner has reasonable grounds to believe that the organization has contravened, is contravening or is likely to contravene Part 1.
ReportIn the course of carrying out an audit, the Commissioner may require the audited organization to, subject to the conditions that the Commissioner may specify, cause to be prepared, and submit to the Commissioner, a report, by a third party that is approved by the Commissioner, on any matter that the Commissioner specifies relating to the organization’s compliance with Part 1.Time limitThe Commissioner must specify the time within which the report is to be submitted.Reasons for refusalIf the Commissioner refuses to approve the third party designated by the organization, the Commissioner must inform the organization in writing of the refusal, setting out the reasons.Assistance and costThe organization must give all reasonable assistance to the third party and is responsible for the cost of the preparation of the report.
Commissioner’s report and recommendationsAfter carrying out an audit, the Commissioner must provide the audited organization with a report that contains the findings of the audit and any recommendations that the Commissioner considers appropriate.Reports may be included in annual reportsThe report may be included in a report made under section 83.
Powers of the Commission and Commissioner — Investigations, Audits and Proceedings
Interim orderIn the course of proceedings in respect of an application referred to in section 109, the Commission may, in exigent circumstances, make any interim order that the Commission considers appropriate.Powers of CommissionThe Commission may, in the course of proceedings in respect of an application referred to in section 109 or an interim order referred to in subsection 123(4),summon and enforce the appearance of persons before the Commission and compel them to give oral or written evidence on oath and to produce any records and things that the Commission considers necessary for the purposes of the proceedings, in the same manner and to the same extent as a superior court of record;administer oaths;receive and accept any evidence and other information, whether on oath, by affidavit or otherwise, that the Commission sees fit, whether or not it is or would be admissible in a court of law;order an organization that has information that is relevant to the proceedings to retain the information for as long as is necessary to allow the Commission to complete the proceedings;at any reasonable time, enter any premises, other than a dwelling-house, occupied by an organization on satisfying the organization’s security requirements for the premises;converse in private with any person in any premises entered under paragraph (e) and otherwise make any inquiries in those premises that the Commission sees fit; andexamine or obtain copies of, or extracts from, records that are found in any premises entered under paragraph (e) and that contain any matter relevant to the proceedings.Return of recordsThe Commission or its delegate must, within a reasonable time, return to a person or an organization any record or thing produced by that person or organization under this section, but nothing precludes the Commission or delegate from again requiring that the record or thing be produced.
Powers of CommissionerIn carrying out an investigation of a complaint or an audit, the Commissioner maysummon and enforce the appearance of persons before the Commissioner and compel them to give oral or written evidence on oath and to produce any records and things that the Commissioner considers necessary to carry out the investigation or audit, in the same manner and to the same extent as a superior court of record;administer oaths;receive and accept any evidence and other information, whether on oath, by affidavit or otherwise, that the Commissioner sees fit, whether or not it is or would be admissible in a court of law;in exigent circumstances, issue a notice of proposed interim order;order an organization that has information that is relevant to the investigation or audit to retain the information for as long as is necessary to allow the Commissioner to carry out the investigation or audit;at any reasonable time, enter any premises, other than a dwelling-house, occupied by an organization on satisfying any security requirements of the organization relating to the premises;converse in private with any person in any premises entered under paragraph (f) and otherwise make any inquiries in those premises that the Commissioner sees fit; andexamine or obtain copies of or extracts from records found in any premises entered under paragraph (f) that contain any matter relevant to the investigation or audit.Return of recordsThe Commissioner or the Commissioner’s delegate must return to a person or an organization any record or thing that they produced under this section within a reasonable time, but nothing precludes the Commissioner or the delegate from again requiring that the record or thing be produced.Notice of proposed interim orderThe notice of proposed interim order referred to in paragraph (1)(d) must includethe proposed interim order;the reasons for the proposed order;the right of the organization and of the complainant to make representations to the Commission within 10 days after the day on which the notice is served, or within any further period set out in the notice, and the procedure for doing so; andthe fact that, if representations are not made in accordance with the notice, the proposed order will be imposed.
RepresentationsWithin the period set out in the notice of proposed interim order, the complainant and the organization may make representations to the Commission in accordance with that notice.HearingThe Commission may conduct a hearing for the purpose of considering the proposed interim order and the reasons for it and may hold all or any part of the hearing in private.Rules of evidenceThe Commission is not bound by any legal or technical rules of evidence in conducting proceedings under subsection (1) and must deal with the matter as informally and expeditiously as the circumstances and considerations of fairness and natural justice permit.Decision — balance or probabilitiesAfter considering the representations, the Commission must decide, on a balance of probabilities, whether or not to make the interim order and may vary its content before making it.Copy of decisionThe Commission must send a copy of the decision and the reasons for it to the complainant and the organization without delay.PresumptionIf neither the complainant nor the organization exercise the remedies referred to in paragraph 122(3)(c), the proposed interim order as proposed is made by the Commission.
Inconsistent interestsIf a member of the Commission who is assigned to hear, or is hearing, proceedings referred to in subsection 123(1), either alone or as a member of a panel, holds any pecuniary or other interest that could be inconsistent with the proper performance of their duties and functions in relation to the proceedings, the member must disclose the interest to the Chairperson without delay. The member must also disclose, without delay, any reason why their participation could result in a reasonable apprehension of bias.Commissioner has no jurisdictionThe Commissioner does not have jurisdiction to hear proceedings referred to in subsection 123(1).For greater certaintyFor greater certainty, a member of the Commission does not lack jurisdiction to hear proceedings referred to in subsection 123(1) by reason only that they participate in the work of the Division.
RulesThe Commission must make rules respecting the conduct of proceedings referred to in subsection 123(1), including the rules of evidence to be followed, and must make those rules publicly available.
Appeals
Right of appealA complainant or organization that is affected by any of the following orders or decisions may appeal it to the Federal Court:a decision made under subsection 110(1);an order made under that subsection; ora decision made under that subsection to change the amount of the penalty.Time limit — appealThe time limit for making an appeal is 30 days after the day on which the Commission makes the decision under subsection 110(1).
Appeal with leaveA complainant or organization that is affected by an interim order made under section 121 or subsection 123(4) may, with leave of the Federal Court, appeal the order to the Federal Court.Time limit — leave to appealThe time limit for making an application for leave to appeal is 30 days after the day on which the order is made.
Disposition of appealsThe Federal Court may dispose of an appeal by dismissing it or by allowing it and, in allowing the appeal, the Federal Court may substitute its own finding, order or decision for the one under appeal or may refer the matter back to the Commission for reconsideration.
Enforcement of Orders
Orders — notice of contraventionAn order made by the Commission under subsection 107(4), (5) or (6) or 108(4), (5) or (6) may, for the purpose of its enforcement, be made an order of the Federal Court and is enforceable in the same manner as an order of that Court.Compliance ordersIf an order made by the Commission under subsection 110(1) is not appealed to the Federal Court or an appeal of the order is dismissed by the Federal Court, the order may, for the purpose of its enforcement, be made an order of the Federal Court and is enforceable in the same manner as an order of that Court.Interim ordersIf an application for leave to appeal an interim order made under subsection 121(1) or 123(4) to the Federal Court is not made, a leave application in relation to the order is dismissed by the Federal Court or the application for leave in relation to the order is granted by the Federal Court but the appeal is dismissed, then the order may, for the purpose of its enforcement, be made an order of the Federal Court and is enforceable in the same manner as an order of that Court.
Filing with CourtAn order referred to in section 129 is made an order of the Federal Court by filing a certified copy of it with the Registrar of that Court.
CostsThe Federal Court may, in accordance with its rules, award costs. However, no costs may be awarded against the Commission unless the Federal Court is satisfiedthat an award is necessary to maintain the public’s confidence in the administration of justice; orthat the absence of an award would have a substantial adverse effect on the other party’s ability to carry on business.
Private Right of Action
Damages — contravention of ActAn individual who is affected by an act or omission by an organization that constitutes a contravention of this Act has a cause of action against the organization for damages for loss or injury that the individual has suffered as a result of the contravention ifthe Commissioner has made a finding under subsection 105(1) or section 106 that the organization has contravened this Act andthe organization has paid the penalty and subsection 107(4) or 108(4) apply, as the case may be,the finding is not the subject of an application for review under section 109 and the time limit for applying for a review set out in a notice of contravention has expired,the Commission has confirmed or varied the finding under subsection 110(1),the finding is not appealed and the time limit for making an appeal under subsection 126(2) has expired, orthe Federal Court has dismissed an appeal of the finding under section 128;the Federal Court has made a finding under section 128 that the organization has contravened this Act;a final decision dismissing any appeal of the finding, or confirming the finding that the organization has contravened this Act, has been made and all rights of appeal have been exhausted; orthe Commissioner has entered into a compliance agreement with the organization under section 103 and the agreement does not provide for the payment of damages for that loss or injury.Damages — offenceIf an organization has been convicted of an offence under section 145, an individual affected by the act or omission that gave rise to the offence has a cause of action against the organization for damages for loss or injury that the individual has suffered as a result of the act or omission.For greater certaintyFor greater certainty, subsections (1) and (2) do not limit or affect an individual’s right to avail themselves of a civil remedy under another Act of Parliament, under an Act of a legislature of a province or at common law.Limitation period or prescriptionAn action must not be brought later than two years after the day on which the individual becomes aware ofin the case of an action under subsection (1),the Commissioner’s finding,if there is a review under section 109, the decision of the Commission, orif there is an appeal, the final decision after all rights of appeal have been exhausted; andin the case of an action under subsection (2), the conviction.Court of competent jurisdictionAn action referred to in subsection (1) or (2) may be brought in the Federal Court or a superior court of a province.
Certificate Under Canada Evidence Act
Certificate under Canada Evidence ActIf a certificate under section 38.13 or 38.41 of the Canada Evidence Act prohibiting the disclosure of personal information of a specific individual is issued before a complaint is filed by that individual under this Act in respect of a request for access to that information, the provisions of this Act respecting that individual’s right of access to their personal information do not apply to the information that is subject to the certificate.Certificate following filing of complaintDespite any other provision of this Act, if a certificate under section 38.13 or 38.41 of the Canada Evidence Act prohibiting the disclosure of personal information of a specific individual is issued after the filing of a complaint under this Act in relation to a request for access to that informationall proceedings under this Act in respect of that information, including an investigation, proceeding in respect of an application referred to in section 109, proceeding in respect of an interim order referred to in subsection 123(4), audit, appeal or judicial review, are discontinued;the Commission, the Commissioner or the Division must not disclose the information and must take all necessary precautions to prevent its disclosure; andthe Commission, the Commissioner and the Division must, within 10 days after the day on which the certificate is published in the Canada Gazette, return the information to the organization that provided the information.Information not to be disclosedThe Commission, the Commissioner and the Division and every person acting on their behalf or under their direction, in exercising their powers and performing their duties and functions under this Act, must not disclose information subject to a certificate issued under section 38.13 or 38.41 of the Canada Evidence Act and must take every reasonable precaution to avoid the disclosure of that information.Power to delegate — CommissionerThe Commissioner must not delegate the investigation in respect of any complaint relating to information subject to a certificate issued under section 38.13 or 38.41 of the Canada Evidence Act except to one of a maximum of four employees of the Commission specifically designated by the Commissioner for the purpose of conducting that investigation.Power to delegate — CommissionThe Commission must not delegate the consideration of an application for a review under section 109, or a proceeding in respect of an interim order referred to in subsection 123(4), that is in relation to information subject to a certificate issued under section 38.13 or 38.41 of the Canada Evidence Act except to one of a maximum of four employees of the Commission specifically designated by the Commission for the purpose of conducting that review or proceeding, as the case may be.
Security requirementsThe Commission, the Commissioner, the Division and any person acting on their behalf or under their direction who receives or obtains information relating to any investigation under this Act must, with respect to access to and the use of that information, satisfy any security requirements applicable to, and take any oath of secrecy required to be taken by, persons who normally have access to and use of that information.
ConfidentialitySubject to subsections (3) to (8), 80(2), 81(3) and 82(1), section 83, paragraph 85(2)(c), section 95, subsections 97(4), 98(2) and 100(1), sections 103 to 106 and subsections 107(2) and (4) to (6), 108(2) and (4) to (6), 110(3), 120(1) and 123(5), the Commission, the Commissioner, the Division and any person acting on their behalf or under their direction must not disclose any information that comes to their knowledge as a result of the exercise of any of their powers or the performance of any of their duties or functions under this Act, other than those referred to in subsection 58(1) or 60(2).Confidentiality — reports and recordsSubject to subsections (3) to (8), 80(2), 81(3) and 82(1), section 83, paragraph 85(2)(c), section 95, subsections 97(4), 98(2) and 100(1), sections 103 to 106 and subsections 107(2) and (4) to (6), 108(2) and (4) to (6), 110(3), 120(1) and 123(5), the Commission, the Commissioner, the Division and any person acting on their behalf or under their direction must not disclose any information contained in a report made under subsection 58(1) or in a record obtained under subsection 60(2).Public interestThe Commission, the Commissioner or the Division may, if they consider that it is in the public interest to do so, make public any information that comes to their knowledge in the exercise of any of their powers or the performance of any of their duties or functions under this Act.Disclosure of necessary informationThe Commission, the Commissioner or the Division may disclose, or may authorize any person acting on their behalf or under their direction to disclose, information that in their opinion is necessary tocarry out an investigation or audit under this Act, consider an application referred to in section 109 or hear a matter referred to in subsection 123(1); orestablish the grounds for findings and recommendations contained in any decision or report made under this Act.Disclosure in the course of proceedingsThe Commission, the Commissioner or the Division may disclose, or may authorize any person acting on their behalf or under their direction to disclose, information in the course ofa prosecution for an offence under section 145;a prosecution for an offence under section 132 of the Criminal Code (perjury) in respect of a statement made under this Act; ora proceeding or an appeal before the Federal Court under this Act.Disclosure of offence authorizedThe Commission, the Commissioner and the Division may disclose to the Attorney General of Canada or of a province, as the case may be, information relating to the commission of an offence under any federal or provincial law on the part of an officer or employee of an organization if, in their opinion, there is evidence of an offence.Disclosure of breach of security safeguardsThe Commission, the Commissioner and the Division may disclose, or may authorize any person acting on their behalf or under their direction to disclose, to a government institution or a part of a government institution, any information contained in a report made under subsection 58(1) or in a record obtained under subsection 60(2) if they have reasonable grounds to believe that the information could be useful in the investigation of a contravention of any federal or provincial law that has been, is being or is about to be committed.DisclosureThe Commission, the Commissioner and the Division disclose information, or may authorize any person acting on their behalf or under their direction to disclose information in accordance with subsection 58(3) or 60(1) of An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act.
Not competent witnessThe Commission, the Commissioner or the Division or any person acting on their behalf or under their direction is not a competent witness in respect of any matter that comes to their knowledge as a result of the exercise of any of their powers or the performance of any of their duties or functions under this Act in any proceeding other thana prosecution for an offence under section 145;a prosecution for an offence under section 132 of the Criminal Code (perjury) in respect of a statement made under this Act; ora proceeding or an appeal before the Federal Court under this Act.
Protection of Commission, Commissioner and DivisionNo criminal or civil proceedings lie against the Commission, the Commissioner or the Division, or against any person acting on their behalf or under their direction, for anything done, reported, decided or said in good faith as a result of the exercise or purported exercise of any of their powers or the performance or purported performance of any of their duties or functions under this Act.DefamationNo action lies in defamation with respect toanything said, any information supplied or any record or thing produced in good faith in the course of an investigation or audit carried out, or proceedings in respect of an application referred to in section 109 or interim order referred to in subsection 123(4), conducted by or on behalf of the Commission, the Commissioner or the Division under this Act; andany report or decision made in good faith by the Commission, the Commissioner or the Division under this Act and any fair and accurate account of the report or decision made in good faith for the purpose of news reporting.
De-identified personal informationFor the purposes of paragraph 75(i), the Division may, on request by an organization, authorize a purpose or situation in which the organization may use de-identified personal information, alone or in combination with other information, to identify an individual if, in the Division’s opinion, it is clearly in the interests of the individual.
General
RegulationsThe Governor in Council may make regulations for carrying out the purposes and provisions of this Act, including regulationsrespecting the anonymization of personal information;respecting the scope of any of the activities set out in paragraphs 18(2)(a) to (c), including specifying activities that are not business activities for the purposes of subsection 18(1);specifying what is a government institution or part of a government institution for the purposes of any provision of this Act;specifying information for the purposes of section 50;respecting the disposal of personal information for the purposes of section 54;respecting security safeguards for the purposes of section 56;specifying information to be kept and maintained under subsection 60(1);respecting an individual’s right of access to their personal information; andprescribing anything that by this Act is to be prescribed.OrdersThe Governor in Council may, by order,provide that this Act is binding on any agent of His Majesty in right of Canada to which the Privacy Act does not apply;if satisfied that legislation of a province that is substantially similar to this Act applies to an organization, a class of organizations, an activity or a class of activities, exempt the organization, activity or class from the application of this Act in respect of the collection, use or disclosure of personal information that occurs within that province; andamend the schedule by adding or deleting, in column 1, the name of an organization or by adding or deleting, in column 2, the description of personal information in relation to an organization in column 1.Regulations — substantially similar provincial legislationThe Governor in Council may make regulations establishingcriteria that are to be applied in making a determination under paragraph (2)(b) that provincial legislation is substantially similar to this Act, or in reconsidering that determination; andthe process for making or reconsidering that determination.
Data mobility frameworksThe Governor in Council may make regulations respecting the disclosure of personal information under section 72, including regulationsrespecting data mobility frameworks and prescribingsafeguards that must be put in place by organizations to enable the secure disclosure of personal information under section 72 and the secure collection of that information, andparameters for the technical means for ensuring interoperability in respect of the disclosure and collection of that information;specifying organizations that are subject to a data mobility framework; andproviding for exceptions to the requirement to disclose personal information, including exceptions related to the protection of proprietary or confidential commercial information.
Distinguishing — classesRegulations made under subsection 139(1) or section 140 may distinguish among different classes of activities, government institutions or parts of government institutions, information, organizations or entities.
Regulations — codes of conduct and certification programsThe Minister may make regulationsrespecting the criteria for and the manner and the circumstances in which a recommendation may be made under paragraph 85(2)(c);respecting the criteria for and the manner and the circumstances in which an approval may be revoked under paragraph 85(2)(d);respecting the making of an application under subsection 92(2);setting out criteria for the purposes of subsection 92(3);respecting the reconsideration of a determination made under subsection 92(3);respecting the making of an application under subsection 93(1);providing for anything else that must be included in a certification program for the purposes of paragraph 93(1)(f);setting out criteria for the purposes of subsection 93(2);respecting the reconsideration of a determination made under subsection 93(2);specifying, for the purposes of section 94, the time for responding to an application; andrespecting record-keeping and reporting obligations of an entity that operates an approved certification program, including obligations to provide reports to the Commission in respect of an approved certification program.
WhistleblowingAny person who has reasonable grounds to believe that a person has contravened or intends to contravene Part 1 may notify the Commission of the particulars of the matter and may request that their identity be kept confidential with respect to the notification.ConfidentialityThe Commission must keep confidential the identity of a person who has notified the Commission under subsection (1) and to whom an assurance of confidentiality has been provided by the Commission.
ProhibitionAn employer must not dismiss, suspend, demote, discipline, harass or otherwise disadvantage an employee, or deny an employee a benefit of employment, by reason thatthe employee, acting in good faith and on the basis of reasonable belief, has disclosed to the Commission that the employer or any other person has contravened or intends to contravene Part 1;the employee, acting in good faith and on the basis of reasonable belief, has refused or stated an intention of refusing to do anything that is a contravention of Part 1;the employee, acting in good faith and on the basis of reasonable belief, has done or stated an intention of doing anything that is required to be done in order that Part 1 not be contravened; orthe employer believes that the employee will do anything referred to in paragraph (a), (b) or (c).SavingNothing in this section impairs any right of an employee, either at law or under an employment contract or collective agreement.Definitions of employee and employerIn this section, employee includes an independent contractor and employer has a corresponding meaning.
Offence and punishmentEvery organization that knowingly contravenes section 58, subsection 60(1), section 69 or 75 or subsection 144(1) or an order made under subsection 110(1), that obstructs the Commissioner or the Commissioner’s delegate in the investigation of a complaint or in carrying out an audit or that obstructs the Commission or the Commission’s delegate in the course of proceedings in respect of an application referred to in section 109 or interim order referred to in subsection 123(4) isguilty of an indictable offence and liable to a fine not exceeding the greater of $25,000,000 and 5% of the organization’s gross global revenue in its financial year before the one in which the organization is sentenced; orguilty of an offence punishable on summary conviction and liable to a fine not exceeding the greater of $20,000,000 and 4% of the organization’s gross global revenue in its financial year before the one in which the organization is sentenced.
Review by parliamentary committeeFive years after the day on which this section comes into force, and every five years after that, a comprehensive review of the provisions and operation of this Act is to be commenced by a committee of the Senate, of the House of Commons or of both Houses of Parliament that may be designated or established by the Senate, the House of Commons or both Houses of Parliament, as the case may be, for that purpose.ReportWithin one year, or any further time that is authorized by the Senate, the House of Commons or both Houses of Parliament, as the case may be, after the day on which the review is commenced, the committee must submit a report on that review to the Senate, the House of Commons or both Houses of Parliament, as the case may be, together with a statement of any changes recommended by the committee.
Coming into Force
Order in councilThe provisions of this Act come into force on a day or days to be fixed by order of the Governor in Council, but that day or those days must not be before the day on which Part 3 of An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts comes into force.
2000, c. 5Personal Information Protection and Electronic Documents Act
The long title of the Personal Information Protection and Electronic Documents Act is replaced by the following:An Act to provide for the use of electronic means to communicate or record information or transactions
Sections 1 to 30 of the Act are replaced by the following:
Short titleThis Act may be cited as the Electronic Documents Act.
Section 31 of the Act is amended by adding the following after subsection (2):Designation of MinisterThe Governor in Council may, by order, designate a member of the King’s Privy Council for Canada as the Minister responsible for this Act.
Parts 3 to 5 of the Act are repealed.
Schedule 1 to the Act is repealed.
Schedule 4 to the Act is repealed.
Digital Safety and Data Protection Commission of CanadaDigital Safety Commission of Canada Act
The long title of the Digital Safety Commission of Canada Act is replaced by the following:An Act to establish the Digital Safety and Data Protection Commission of Canada
Section 1 of the Act is replaced by the following:
Alternative titleThis Act may be cited as the Digital Safety and Data Protection Commission of Canada Act.
The definition Commission in section 2 of the Act is replaced by the following:Commission means the Digital Safety and Data Protection Commission of Canada established by section 4. (Commission)
Section 4 of the Act is replaced by the following:
CommissionThe Digital Safety and Data Protection Commission of Canada is established.
Section 6 of the Act is amended by adding the following after subsection (1):Protecting Privacy and Consumer Data ActThe Commission exercises the powers and performs the duties and functions conferred on it under the Protecting Privacy and Consumer Data Act.
Section 10 of the Act is replaced by the following:
CompositionThe Commission consists of five full-time members to be appointed by the Governor in Council to hold office during good behaviour. The Governor in Council may remove a member at any time for cause.
Section 19 of the Act is replaced by the following:
ArrangementsThe Chairperson may, on behalf of the Commission, enter into contracts, memoranda of understanding or other agreements or arrangements — except agreements or arrangements referred to in section 120 of the Digital Safety Act or section 79 or subsection 80(1), 81(2) or 82(3) or (4) of the Protecting Privacy and Consumer Data Act — either in the name of His Majesty or in the name of the Commission.
Section 22 of the Act is replaced by the following:
Personal informationA report referred to in subsection 21(1) must not contain personal information, as defined in subsection 2(1) of the Protecting Privacy and Consumer Data Act.
Digital Safety Act
The definitions Commission and personal information in subsection 2(1) of the Digital Safety Act are replaced by the following:Commission means the Digital Safety and Data Protection Commission of Canada established by section 4 of the Digital Safety and Data Protection Commission of Canada Act. (Commission)personal information has the same meaning as in subsection 2(1) of the Protecting Privacy and Consumer Data Act. (renseignements personnels)
Paragraph 18(c) of the Act is replaced by the following:privacy rights and, to the extent it considers appropriate, the purpose of the Protecting Privacy and Consumer Data Act;
Section 122 of the Act is repealed.
The Act is amended by replacing “Digital Safety Commission of Canada Act” with “Digital Safety and Data Protection Commission of Canada Act” in the following provisions:the portion of section 73 before paragraph (a);the portion of subsection 75(1) before paragraph (a);the portion of subsection 117(1) before paragraph (a); andsubsection 119(2) and the portion of subsection 119(3) before paragraph (a).
Consequential AmendmentsR.S., c. A-1Access to Information Act
The reference toDigital Safety Commission of CanadaCommission canadienne de la sécurité numériquein Schedule I to the Access to Information Act under the heading “Other Government Institutions” is replaced by the following:Digital Safety and Data Protection Commission of CanadaCommission canadienne de la sécurité numérique et de la protection des données
R.S., c. F-11Financial Administration Act
The reference toDigital Safety Commission of CanadaCommission canadienne de la sécurité numérique in column I of Schedule I.1 to the Financial Administration Act is replaced by the following:Digital Safety and Data Protection Commission of CanadaCommission canadienne de la sécurité numérique et de la protection des données
The reference toDigital Safety Commission of CanadaCommission canadienne de la sécurité numériquein Schedule IV to the Act is replaced by the following:Digital Safety and Data Protection Commission of CanadaCommission canadienne de la sécurité numérique et de la protection des données
The reference toDigital Safety Commission of CanadaCommission canadienne de la sécurité numérique in column I of Part III of Schedule VI to the Act is replaced by the following:Digital Safety and Data Protection Commission of CanadaCommission canadienne de la sécurité numérique et de la protection des données
R.S., c. P-21Privacy Act
The reference toDigital Safety Commission of CanadaCommission canadienne de la sécurité numériquein the schedule to the Privacy Act under the heading “Other Government Institutions” is replaced by the following:Digital Safety and Data Protection Commission of CanadaCommission canadienne de la sécurité numérique et de la protection des données
R.S., c. P-36Public Service Superannuation Act
The reference toDigital Safety Commission of CanadaCommission canadienne de la sécurité numérique in Part I of Schedule I to the Public Service Superannuation Act is replaced by the following:Digital Safety and Data Protection Commission of CanadaCommission canadienne de la sécurité numérique et de la protection des données
Consequential and Related Amendments, Transitional Provision, Coordinating Amendments and Coming into ForceConsequential and Related AmendmentsR.S., c. A-1Access to Information Act
Schedule II to the Access to Information Act is amended by striking out the reference toPersonal Information Protection and Electronic Documents ActLoi sur la protection des renseignements personnels et les documents électroniquesand the corresponding reference to “subsection 20(1.1)”.Schedule II to the Act is amended by adding, in alphabetical order, a reference toProtecting Privacy and Consumer Data Act Loi visant à protéger la vie privée et les données des consommateursand a corresponding reference to “subsection 135(2)”.
R.S., c. A-2Aeronautics Act
Subsection 4.83(1) of the Aeronautics Act is replaced by the following:
Foreign states requiring informationDespite Part 1 of the Protecting Privacy and Consumer Data Act, to the extent that that Part relates to obligations relating to the disclosure of information, an operator of an aircraft departing from Canada that is due to land in a foreign state or fly over the United States and land outside Canada or of a Canadian aircraft departing from any place outside Canada that is due to land in a foreign state or fly over the United States may, in accordance with the regulations, provide to a competent authority in that foreign state any information that is in the operator’s control relating to persons on board or expected to be on board the aircraft and that is required by the laws of the foreign state.
R.S., c. C-5Canada Evidence Act
Item 14 of the schedule to the Canada Evidence Act is replaced by the following:The Digital Safety and Data Protection Commission of Canada, for the purposes of the Protecting Privacy and Consumer Data Act
Item 17 of the schedule to the Act is replaced by the following:A judge of the Federal Court, for the purposes of the Protecting Privacy and Consumer Data Act
R.S., c. C-22Canadian Radio-television and Telecommunications Commission Act
The Canadian Radio-television and Telecommunications Commission Act is amended by adding the following after section 12:
Agreements or arrangements — Digital Safety and Data Protection Commission of CanadaThe Commission may enter into an agreement or arrangement with the Digital Safety and Data Protection Commission of Canada in order tocoordinate the activities of their respective offices, including providing for mechanisms for handling complaints of mutual interest;undertake and publish research on issues of mutual interest; anddevelop procedures for disclosing information referred to in subsection (2).Disclosure of informationThe Commission may, in accordance with any procedure established under paragraph (1)(c), disclose information to the Digital Safety and Data Protection Commission of Canada if the information is relevant to its powers, duties or functions under the Protecting Privacy and Consumer Data Act.Purpose and confidentialityThe procedures referred to in paragraph (1)(c) shallrestrict the use of the information to the purpose for which it was originally disclosed; andstipulate that the information be treated in a confidential manner and not be further disclosed without the express consent of the Commission.
R.S., c. C-34; R.S., c. 19 (2nd Supp.), s. 19Competition Act
The Competition Act is amended by adding the following after section 29.2:
Agreements or arrangements — Digital Safety and Data Protection Commission of CanadaDespite subsection 29(1), the Commissioner may enter into an agreement or arrangement with the Digital Safety and Data Protection Commission of Canada in order tocoordinate the activities of their respective offices, including providing for mechanisms for handling complaints of mutual interest;undertake and publish research on issues of mutual interest; anddevelop procedures for disclosing information referred to in subsection (2).Disclosure of informationThe Commissioner may, in accordance with any procedure established under paragraph (1)(c), disclose information to the Digital Safety and Data Protection Commission of Canada if the information is relevant to its powers, duties or functions under the Protecting Privacy and Consumer Data Act.Purpose and confidentialityThe procedures referred to in paragraph (1)(c) shallrestrict the use of the information to the purpose for which it was originally disclosed; andstipulate that the information be treated in a confidential manner and not be further disclosed without the express consent of the Commissioner.
R.S., c. C-44; 1994, c. 24, s. 1(F)Canada Business Corporations Act
Subsection 21.1(5) of the Canada Business Corporations Act is replaced by the following:Disposal of personal informationWithin one year after the sixth anniversary of the day on which an individual ceases to be an individual with significant control over the corporation, the corporation shall — subject to any other Act of Parliament and to any Act of the legislature of a province that provides for a longer retention period — dispose of any of that individual’s personal information, as defined in subsection 2(1) of the Protecting Privacy and Consumer Data Act, that is recorded in the register.
R.S., c. 32 (4th Supp.)Railway Safety Act
Subsection 17.91(4) of the Railway Safety Act is replaced by the following:Protecting Privacy and Consumer Data Act and provincial legislationA company that collects, uses or communicates information under this section, section 17.31 or 17.94, subsection 28(1.1) or 36(2) or regulations made under section 17.95 may do sodespite Part 1 of the Protecting Privacy and Consumer Data Act, to the extent that that Part relates to obligations relating to the collection, use, disclosure, retention and disposal of information; anddespite any provision of provincial legislation that is substantially similar to that Act and that limits the collection, use, communication or preservation of information.
1991, c. 11Broadcasting Act
Subsection 25.3(2) of the Broadcasting Act is replaced by the following:Information not to be disclosedSubject to subsections (4) to (5.1) and (7), if a person designates information as confidential and the designation is not withdrawn by that person, no person described in subsection (3) shall knowingly disclose the information, or knowingly allow it to be disclosed, to any other person in any manner that is intended or likely to make it available for the use of any person who may benefit from the information or use it to the detriment of any person to whose business or affairs the information relates.Section 25.3 of the Act is amended by adding the following after subsection (5):Disclosure to Digital Safety and Data Protection Commission of CanadaThe Commission may disclose designated information obtained by it in the exercise of its powers or the performance of its duties or functions under this Act to the Digital Safety and Data Protection Commission of Canada in accordance with section 12.1 of the Canadian Radio-television and Telecommunications Commission Act.
1993, c. 38Telecommunications Act
Subsection 39(2) of the Telecommunications Act is replaced by the following:Information not to be disclosedSubject to subsections (4), (5) and (5.1) to (6), if a person designates information as confidential and the designation is not withdrawn by that person, no person described in subsection (3) shall knowingly disclose the information, or knowingly allow it to be disclosed, to any other person in any manner that is calculated or likely to make it available for the use of any person who may benefit from the information or use the information to the detriment of any person to whose business or affairs the information relates.Section 39 of the Act is amended by adding the following after subsection (5.1):Disclosure to Digital Safety and Data Protection Commission of CanadaThe Commission may disclose designated information obtained by it in the exercise of its powers or the performance of its duties or functions under this Act to the Digital Safety and Data Protection Commission of Canada in accordance with section 12.1 of the Canadian Radio-television and Telecommunications Commission Act.
2005, c. 46Public Servants Disclosure Protection Act
Paragraph 15(a) of the Public Servants Disclosure Protection Act is replaced by the following:Part 1 of the Protecting Privacy and Consumer Data Act, to the extent that that Part relates to obligations relating to the disclosure of information; and
Subsection 16(1.1) of the Act is replaced by the following:LimitationSubsection (1) does not apply in respect of information the disclosure of which is subject to any restriction created by or under any Act of Parliament, including the Protecting Privacy and Consumer Data Act.
Section 50 of the Act is replaced by the following:
Personal informationDespite Part 1 of the Protecting Privacy and Consumer Data Act, to the extent that that Part relates to obligations relating to the disclosure of information, and despite any other Act of Parliament that restricts the disclosure of information, a report by a chief executive in response to recommendations made by the Commissioner to the chief executive under this Act may include personal information within the meaning of subsection 2(1) of that Act, or section 3 of the Privacy Act, depending on which of those Acts applies to the portion of the public sector for which the chief executive is responsible.
2010, c. 23Chapter 23 of the Statutes of Canada, 2010
The definition Privacy Commissioner in subsection 1(1) of An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act is replaced by the following:Privacy and Consumer Data Commissioner means the Privacy and Consumer Data Commissioner, as designated under section 85 of the Protecting Privacy and Consumer Data Act. (Commissaire à la protection de la vie privée et des données des consommateurs)Subsection 1(1) of the Act is amended by adding the following in alphabetical order:Digital Safety and Data Protection Commission of Canada means the Digital Safety and Data Protection Commission of Canada referred to in section 4 of the Digital Safety and Data Protection Commission of Canada Act. (Commission canadienne de la sécurité numérique et de la protection des donnée)Division means the Privacy and Consumer Data Division established under section 89 of the Protecting Privacy and Consumer Data Act. (Section)
Section 2 of the Act is replaced by the following:
Precedence of this ActIn the event of a conflict between a provision of this Act and a provision of the Protecting Privacy and Consumer Data Act, the provision of this Act operates despite the provision of that Act, to the extent of the conflict.
Paragraph 20(3)(c) of the Act is replaced by the following:the person’s history with respect toany previous violation of this Act,any previous conduct that is reviewable under section 74.011 of the Competition Act,any previous contravention of section 5 of the Personal Information Protection and Electronic Documents Act, as it read immediately before the day on which section 3 of An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts comes into force, that relates to a collection or use described in subsection 7.1(2) or (3) of the Personal Information Protection and Electronic Documents Act, as it read immediately before that day, andany previous contravention of Part 1 of the Protecting Privacy and Consumer Data Act that relates to a collection or use described in subsection 51(2) or (3) of that Act;
Sections 52 to 54 of the Act are replaced by the following:
Directors and officers of corporationsAn officer, director or agent or mandatary of a corporation that commits a contravention of any of sections 6 to 9 of this Act or a contravention of Part 1 of the Protecting Privacy and Consumer Data Act that relates to a collection or use described in subsection 51(2) or (3) of that Act, or that engages in conduct that is reviewable under section 74.011 of the Competition Act, is liable for the contravention or reviewable conduct, as the case may be, if they directed, authorized, assented to, acquiesced in or participated in the commission of that contravention, or engaged in that conduct, whether or not the corporation is proceeded against.
Vicarious liabilityA person is liable for a contravention of any of sections 6 to 9 of this Act or a contravention of Part 1 of the Protecting Privacy and Consumer Data Act that relates to a collection or use described in subsection 51(2) or (3) of that Act, or for conduct that is reviewable under section 74.011 of the Competition Act, that is committed or engaged in, as the case may be, by their employee acting within the scope of their employment or their agent or mandatary acting within the scope of their authority, whether or not the employee or agent or mandatary is identified or proceeded against.
DefenceA person must not be found to have committed a contravention of any of sections 6 to 9 of this Act or a contravention of Part 1 of the Protecting Privacy and Consumer Data Act that relates to a collection or use described in subsection 51(2) or (3) of that Act, or to have engaged in conduct that is reviewable under section 74.011 of the Competition Act, if they establish that they exercised due diligence to prevent the contravention or conduct, as the case may be.Common law principlesEvery rule and principle of the common law that makes any circumstance a justification or excuse in relation to a charge for an offence applies in respect of a contravention or conduct referred to in subsection (1), to the extent that it is not inconsistent with this Act, the Protecting Privacy and Consumer Data Act or the Competition Act, as the case may be.
The portion of section 56 of the Act before paragraph (a) is replaced by the following:
Disclosure by an organizationAny organization to which the Protecting Privacy and Consumer Data Act applies may on its own initiative disclose to the Commission, the Commissioner of Competition or the Digital Safety and Data Protection Commission of Canada any information in its possession that it believes relates to
Subparagraph 56(a)(iii) of the Act is replaced by the following:Part 1 of the Protecting Privacy and Consumer Data Act, which contravention relates to a collection or use described in subsection 51(2) or (3) of that Act, or
Section 57 of the Act is replaced by the following:
ConsultationThe Commission, the Commissioner of Competition and the Digital Safety and Data Protection Commission must consult with each other to the extent that they consider appropriate to ensure the effective regulation, under this Act, the Competition Act, the Protecting Privacy and Consumer Data Act and the Telecommunications Act, of commercial conduct that discourages the use of electronic means to carry out commercial activities, and to coordinate their activities under those Acts as they relate to the regulation of that type of conduct.
Paragraph 58(1)(a) of the Act is replaced by the following:to the Digital Safety and Data Protection Commission of Canada, if the information relates to the exercise of the powers of the Digital Safety and Data Protection Commission of Canada, the Privacy and Consumer Data Commissioner or the Division or the performance of its duties or functions under the Protecting Privacy and Consumer Data Act in respect of a collection or use described in subsection 51(2) or (3) of that Act; andParagraph 58(2)(a) of the Act is replaced by the following:to the Digital Safety and Data Protection Commission of Canada, if the Commissioner of Competition believes that the information relates to the exercise of the powers of the Digital Safety and Data Protection Commission of Canada, the Privacy and Consumer Data Commissioner or the Division or the performance of its duties or functions under the Protecting Privacy and Consumer Data Act in respect of a collection or use described in subsection 51(2) or (3) of that Act; andThe portion of subsection 58(3) of the Act before paragraph (a) is replaced by the following:Disclosure by Digital Safety and Data Protection Commission of CanadaThe Digital Safety and Data Protection Commission of Canada may disclose information obtained by it in the exercise of its powers or the performance of its duties or functions under the Protecting Privacy and Consumer Data Act if the information relates to a collection or use described in subsection 51(2) or (3) of that Act or to an act alleged in a complaint in respect of which the Privacy and Consumer Data Commissioner decides, under section 99 of that Act, to not conduct an investigation or to discontinue an investigation,
Subsection 59(3) of the Act is replaced by the following:Use of information by Digital Safety and Data Protection Commission of CanadaThe Digital Safety and Data Protection Commission of Canada may use the information that is disclosed to it under paragraph 58(1)(a) or (2)(a) only for the purpose of exercising the powers of the Digital Safety and Data Protection Commission of Canada, the Privacy and Consumer Data Commissioner or the Division or performing its duties or functions under the Protecting Privacy and Consumer Data Act in respect of a collection or use described in subsection 51(2) or (3) of that Act.
The portion of subsection 60(1) of the Act before paragraph (a) is replaced by the following:
Information shared with the government of a foreign state, etc.Information may be disclosed under an agreement or arrangement in writing between the Government of Canada, the Commission, the Commissioner of Competition or the Digital Safety and Data Protection Commission of Canada and the government of a foreign state, an international organization of states or an international organization established by the governments of states, or any institution of any such government or organization, if the person responsible for disclosing the information believes that
Subparagraph 60(1)(a)(ii) of the Act is replaced by the following:conduct that contravenes Part 1 of the Protecting Privacy and Consumer Data Act and that relates to a collection or use described in subsection 51(2) or (3) of that Act,Subparagraph 60(1)(b)(iii) of the Act is replaced by the following:the exercise by the Digital Safety and Data Protection Commission of Canada, the Privacy and Consumer Data Commissioner or the Division of its powers or the performance of its duties or functions under the Protecting Privacy and Consumer Data Act in respect of a collection or use described in subsection 51(2) or (3) of that Act, orSubsection 60(3) of the Act is replaced by the following:Restriction — arrangementsAn arrangement referred to in subsection (1) entered into by the Commission or the Digital Safety and Data Protection Commission of Canada may be in respect only of contraventions of the laws of a foreign state that have consequences that would not be considered penal under Canadian law.Subsection 60(5) of the Act is replaced by the following:ClarificationFor the purposes of this section, an arrangement may be created by the acceptance, by the Government of Canada, the Commission, the Commissioner of Competition or the Digital Safety and Data Protection Commission of Canada, of a written request for assistance from the government of a foreign state, an international organization of states or an international organization established by the governments of states, or any institution of any such government or organization, if the request is accompanied by a declaration that the party making the request will provide assistance to the party to whom the request is made on a reciprocal basis.
Section 61 of the Act is replaced by the following:
Reports to Minister of IndustryThe Commission, the Commissioner of Competition and the Digital Safety and Data Protection Commission of Canada must provide the Minister of Industry with any reports that the Minister requests for the purpose of coordinating the implementation of sections 6 to 9 of this Act, sections 52.01 and 74.011 of the Competition Act and section 51 of the Protecting Privacy and Consumer Data Act.
Terminology
Replacement of “Personal Information Protection and Electronic Documents Act”Every reference to the “Personal Information Protection and Electronic Documents Act” is replaced by a reference to the “Electronic Documents Act” in the following provisions:the definition secure electronic signature in section 31.8 of the Canada Evidence Act;subsection 95(2) of the Canadian Forces Superannuation Act;subsections 252.6(2) and (3) of the Canada Business Corporations Act;subsection 74(2) of the Public Service Superannuation Act;subsection 44(2) of the Royal Canadian Mounted Police Superannuation Act;subparagraph 205.124(1)(u)(ii) of the Canada–Newfoundland and Labrador Atlantic Accord Implementation and Offshore Renewable Energy Management Act;subparagraph 210.126(1)(u)(ii) of the Canada–Nova Scotia Offshore Petroleum Resources Accord Implementation and Offshore Renewable Energy Management Act;subsections 539.1(2) and (3) of the Trust and Loan Companies Act;subsections 1001(2) and (3) of the Bank Act;subsections 1043(2) and (3) of the Insurance Companies Act;subsections 487.1(2) and (3) of the Cooperative Credit Associations Act;subsections 361.6(2) and (3) of the Canada Cooperatives Act; andsubsections 269(2) and (3) of the Canada Not-for-profit Corporations Act.
Transitional Provision
RegulationsThe Governor in Council may make regulations respecting any transitional matter arising from the coming into force of the provisions of the Protecting Privacy and Consumer Data Act.
Coordinating Amendments
2026, c. 3In this section, “other Act” means the Budget 2025 Implementation Act, No. 1.If section 3 of this Act comes into force before Division 23 of Part 5 of the other Act, then that Division 23 is repealed.If section 3 of this Act comes into force on the same day as Division 23 of Part 5 of the other Act, then that Division 23 is deemed never to have come into force and is repealed.
Coming into Force
Order in councilThe provisions of this Act, other than sections 1 and 51 and Part 3, come into force on a day to be fixed by order of the Governor in Council, but that day must not be before the day on which that Part 3 comes into force.Order in councilIf Bill C-34, introduced in the 1st session of the 45th Parliament and entitled the Safe Social Media Act, receives royal assent, then Part 3 of this Act comes into force on a day to be fixed by order of the Governor in Council, but that day must not be before the day on which section 4 of the Digital Safety Commission of Canada Act, as enacted by section 4 of the Safe Social Media Act, comes into force.
(Section 1)(Subsection 6(3) and paragraph 139(2)(c))OrganizationsColumn 1Column 2ItemOrganizationPersonal Information1World Anti-Doping AgencyAgence mondiale antidopagePersonal information that the organization collects, uses or discloses in the course of its interprovincial or international activities