MINISTER OF ARTIFICIAL INTELLIGENCE AND DIGITAL INNOVATION

TABLE OF PROVISIONS

An Act to support and promote digital commerce by protecting personal information that is collected, used or disclosed in the course of commercial activities

Short Title

Short title

Interpretation

Definitions

alternative format, with respect to personal information, means a format that allows an individual with a sensory disability to read or listen to the personal information.‍ (support de substitution)

anonymize means to irreversibly and permanently modify personal information to ensure that there is no reasonably foreseeable risk in the circumstances that an individual can be identified from the information, whether directly or indirectly, by any means.‍ (anonymiser)

automated decision system means any technology that assists or replaces the judgment of human decision-makers through the use of a rules-based system, regression analysis, predictive analytics, machine learning, deep learning, a neural network or other technique.‍ (système décisionnel automatisé)

breach of security safeguards means the loss of, unauthorized access to or unauthorized disclosure of personal information resulting from a breach of an organization’s security safeguards that are referred to in section 56 or from a failure to establish those safeguards.‍ (atteinte aux mesures de sécurité)

business transaction includes

• (a) the purchase, sale or other acquisition or disposition of an organization or a part of an organization, or any of its assets;

• (b) the merger or amalgamation of two or more organizations;

• (c) the making of a loan or provision of other financing to an organization or a part of an organization;

• (d) the creating of a charge on, or the taking of a security interest in or a security on, any assets or securities of an organization;

• (e) the lease or licensing of any of an organization’s assets; and

• (f) any other prescribed arrangement between two or more organizations to conduct a business activity.‍ (transaction commerciale)

Chairperson means the Chairperson of the Commission, as designated under subsection 17(1) of the Digital Safety and Data Protection Commission of Canada Act.‍ (président)

child means an individual who is under 18 years of age.‍ (enfant)

commercial activity means any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.‍ (activité commerciale)

Commission means the Digital Safety and Data Protection Commission of Canada referred to in section 4 of the Digital Safety and Data Protection Commission of Canada Act.‍ (Commission)

Commissioner means the Privacy and Consumer Data Commissioner, as designated under subsection 85(1).‍ (commissaire)

de-identify means to modify personal information so that an individual cannot be directly identified from it, although a risk of the individual being identified remains.‍ (dépersonnaliser)

Division means the Privacy and Consumer Data Division established under section 89.‍ (Section)

dispose means to permanently and irreversibly delete personal information or to anonymize it.‍ (retrait)

federal work, undertaking or business means any work, undertaking or business that is within the legislative authority of Parliament. It includes

• (a) a work, undertaking or business that is operated or carried on for or in connection with navigation and shipping, whether inland or maritime, including the operation of ships and transportation by ship anywhere in Canada;

• (b) a railway, canal, telegraph or other work or undertaking that connects a province with another province, or that extends beyond the limits of a province;

• (c) a line of ships that connects a province with another province, or that extends beyond the limits of a province;

• (d) a ferry between a province and another province or between a province and a country other than Canada;

• (e) aerodromes, aircraft or a line of air transportation;

• (f) a radio broadcasting station;

• (g) a bank or an authorized foreign bank as those terms are defined in section 2 of the Bank Act;

• (h) a work that, although wholly situated within a province, is before or after its execution declared by Parliament to be for the general advantage of Canada or for the advantage of two or more provinces;

• (i) a work, undertaking or business outside the exclusive legislative authority of the legislatures of the provinces; and

• (j) a work, undertaking or business to which federal laws, as defined in section 2 of the Oceans Act, apply under section 20 of that Act and any regulations made under paragraph 26(1)‍(k) of that Act.‍ (entreprises fédérales)

Minister means the member of the King’s Privy Council for Canada designated under section 3 or, if no member is designated, the Minister of Industry.‍ (ministre)

organization includes an association, a partnership, a person or a trade union.‍ (organisation)

personal information means information about an identifiable individual, including information that is inferred about the individual.‍ (renseignement personnel)

prescribed means prescribed by regulation.‍ (Version anglaise seulement)

record means any documentary material, regardless of medium or form.‍ (document)

sensitive describes personal information in respect of which, taking into account the circumstances, an individual has a heightened expectation of privacy, including, as the case may be, a child’s personal information, personal information revealing an individual’s racial or ethnic origin, political opinions or religious or philosophical beliefs, an individual’s trade union membership, genetic information or health information, biometric information that is capable of uniquely identifying the individual or information concerning an individual’s sexual orientation.‍ (caractère sensible)

service provider means an organization, including a parent corporation, subsidiary, affiliate, contractor or subcontractor, that provides services for or on behalf of another organization to assist the organization in fulfilling its purposes.‍ (fournisseur de services)

Interpretation — de-identified personal information

Order designating Minister

Authorized representatives

• (a) on behalf of a child, by a parent, guardian or tutor, unless the child wishes to personally exercise those rights and is capable of doing so;

• (b) on behalf of an individual, other than a child, under a legal incapacity, by a person authorized by law to administer the affairs or property of that individual;

• (c) on behalf of a deceased individual, by a person authorized by law to administer the estate or succession of that individual, but only for the purpose of that administration; and

• (d) on behalf of any other individual, by a person authorized in writing by that individual to do so.

Purpose and Application

Purpose

Application

• (a) the organization collects, uses or discloses in the course of commercial activities; or

• (b) is about an employee of, or an applicant for employment with, the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business.

For greater certainty

• (a) that is collected, used or disclosed interprovincially or internationally by an organization; or

• (b) that is collected, used or disclosed by an organization within a province, to the extent that the organization is not exempt from the application of this Act under an order made under paragraph 139(2)‍(b).

Application

Non-application

• (a) any government institution to which the Privacy Act applies;

• (b) any individual in respect of personal information that the individual collects, uses or discloses solely for personal or domestic purposes;

• (c) any organization in respect of personal information that the organization collects, uses or discloses solely for journalistic, artistic or literary purposes;

• (d) any organization in respect of an individual’s personal information that the organization collects, uses or discloses solely for the purpose of communicating or facilitating communication with the individual in relation to their employment, business or profession; or

• (e) any organization that is, under an order made under paragraph 139(2)‍(b), exempt from the application of this Act in respect of the collection, use or disclosure of personal information that occurs within a province in respect of which the order was made.

For greater certainty

Other Acts

PART 1 

Obligations of Organizations

Accountability of Organizations

• (a) the protection of personal information;

• (b) how requests for information and complaints are received and dealt with;

• (c) the training and information provided to the organization’s staff respecting its policies, practices and procedures; and

• (d) the development of materials to explain the organization’s policies and procedures.

Appropriate Purposes

• (a) the sensitivity of the personal information;

• (b) whether the purposes represent legitimate business needs of the organization;

• (c) the degree of effectiveness of the collection, use or disclosure in meeting the organization’s legitimate business needs;

• (d) whether there are less intrusive means of achieving those purposes at a comparable cost and with comparable benefits; and

• (e) whether the individual’s loss of privacy is proportionate to the benefits in light of the measures, technical or otherwise, implemented by the organization to mitigate the impacts of the loss of privacy on the individual.

Limiting Collection, Use and Disclosure

• (a) use personal information for a purpose other than a purpose determined and recorded under subsection 12(3) in any of the circumstances set out in sections 18, 20 and 21, subsections 22(1) and (3) and sections 23, 24, 26, 30, 39 and 50; or

• (b) disclose personal information for a purpose other than a purpose determined and recorded under subsection 12(3) in any of the circumstances set out in section 18, subsections 22(1) and (3), sections 23 to 28 and 31 to 36, subsection 38(3) and sections 40 to 50.

Consent

• (a) the purposes for the collection, use or disclosure of the personal information determined by the organization and recorded under subsection 12(3) or (4);

• (b) the manner in which the personal information is to be collected, used or disclosed;

• (c) any reasonably foreseeable consequences of the collection, use or disclosure of the personal information;

• (d) the specific type of personal information that is to be collected, used or disclosed; and

• (e) the names of any third parties or types of third parties to which the organization may disclose the personal information.

Exceptions to Requirement for Consent

• (a) a reasonable person would expect the collection or use for such an activity; and

• (b) the personal information is not collected or used for the purpose of influencing the individual’s behaviour or decisions.

• (a) an activity that is necessary to provide a product or service that the individual has requested from the organization;

• (b) an activity that is necessary for the security of the organization’s information, systems or networks;

• (c) an activity that is necessary for the safety of a product or service that the organization provides; and

• (d) any other prescribed activity.

• (a) a reasonable person would expect the collection, use or disclosure for such an activity; and

• (b) the personal information is not collected, used or disclosed for the purpose of influencing the individual’s behaviour or decisions.

• (a) identify and describe its legitimate interest in the proposed activity;

• (b) carry out, in accordance with the prescribed requirements, a privacy impact assessment in which the organization must identify any reasonably foreseeable adverse effect on the individual that is likely to result from the collection, use or disclosure;

• (c) identify and take reasonable measures to reduce the likelihood that the effects will occur or to mitigate or eliminate them; and

• (d) comply with any prescribed requirements.

• (a) the information is de-identified before it is used or disclosed and remains so until the transaction is completed;

• (b) the organizations have entered into an agreement that requires the organization that receives the information

  • (i) to use and disclose that information solely for purposes related to the transaction,

  • (ii) to protect the information by security safeguards proportionate to the sensitivity of the information, and

  • (iii) if the transaction does not proceed, to return the information to the organization that disclosed it, or dispose of it, within a reasonable time;

• (c) the organizations comply with the terms of that agreement; and

• (d) the information is necessary

  • (i) to determine whether to proceed with the transaction, and

  • (ii) if the determination is made to proceed with the transaction, to complete it.

• (a) the organizations have entered into an agreement that requires each of them

  • (i) to use and disclose the information under its control solely for the purposes for which the information was collected or permitted to be used or disclosed before the transaction was completed,

  • (ii) to protect that information by security safeguards proportionate to the sensitivity of the information, and

  • (iii) to give effect to any withdrawal of consent made under subsection 17(1);

• (b) the organizations comply with the terms of that agreement;

• (c) the information is necessary for carrying on the business or activity that was the object of the transaction; and

• (d) one of the parties notifies the individual, within a reasonable time after the transaction is completed, that the transaction has been completed and that their information has been disclosed under subsection (1).

• (a) the collection, use or disclosure is necessary to establish, manage or terminate an employment relationship between the organization and the individual in connection with the operation of a federal work, undertaking or business; and

• (b) the organization has informed the individual that the personal information will be or may be collected, used or disclosed for those purposes.

• (a) the organization has reasonable grounds to believe that the individual has been, is or may be the victim of financial abuse;

• (b) the disclosure is made solely for purposes related to preventing or investigating the abuse; and

• (c) it is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the ability to prevent or investigate the abuse.

• (a) 100 years after the record containing the information was created, and

• (b) 20 years after the death of the individual.

• (a) the disclosure is made to the other organization, government institution or part of a government institution that was notified of a breach under subsection 59(1); and

• (b) the disclosure is made solely for the purpose of reducing the risk of harm to the individual that could result from the breach or mitigating that harm.

access means to program, execute programs on, communicate with, store data in, retrieve data from or otherwise make use of any resources, including data or programs of a computer system or a computer network.‍ (utiliser)

computer program has the same meaning as in subsection 342.‍1(2) of the Criminal Code.‍ (programme d’ordinateur)

computer system has the same meaning as in subsection 342.‍1(2) of the Criminal Code.‍ (ordinateur)

electronic address means an address used in connection with

• (a) an electronic mail account;

• (b) an instant messaging account; or

• (c) any similar account.‍ (adresse électronique)

• (a) collect an individual’s electronic address without their knowledge or consent, if the address is collected by the use of a computer program that is designed or marketed primarily for use in generating or searching for, and collecting, electronic addresses; or

• (b) use an individual’s electronic address without their knowledge or consent, if the address is collected by the use of a computer program described in paragraph (a).

• (a) collect an individual’s personal information without their knowledge or consent, through any means of telecommunication, if the information is collected by accessing a computer system or causing a computer system to be accessed in contravention of an Act of Parliament; or

• (b) use an individual’s personal information without their knowledge or consent, if the information is collected in a manner described in paragraph (a).

Retention and Disposal of Personal Information

• (a) fulfill the purposes for which the information was collected, used or disclosed; or

• (b) comply with the requirements of this Act, of federal or provincial law or of the reasonable terms of a contract.

The organization must dispose of the information as soon as feasible after that period.

• (a) the information was collected, used or disclosed in contravention of this Act;

• (b) the individual has withdrawn their consent, in whole or in part, to the collection, use or disclosure of the information; or

• (c) the information is no longer necessary for the continued provision of a product or service requested by the individual.

• (a) the disposal of the information would result in the disposal of personal information about another individual and the information cannot be severed without imposing an undue burden on the organization;

• (b) there are other requirements of this Act, of federal or provincial law or of the reasonable terms of a contract that prevent it from disposing of the information;

• (c) the information is necessary for the establishment of a legal defence or in the exercise of other legal remedies by the organization;

• (d) the information is not in relation to a child and the disposal of the information would have an undue adverse effect on the accuracy or integrity of information that is necessary to the ongoing provision of a product or service to the individual in question;

• (e) the request is vexatious or made in bad faith; or

• (f) the disposal of the information would have an undue adverse effect on the organization that outweighs any potential adverse effect on the individual resulting from the retention of the information.

• (a) inform them in writing of the refusal, setting out the reasons and any recourse that they may have under section 73 or subsection 97(1); and

• (b) in the case of a request that is refused under paragraph (2)‍(f), inform the Commission in writing of the refusal, setting out the reasons.

Accuracy of Personal Information

• (a) whether the information may be used to make a decision about the individual;

• (b) whether the information is used on an ongoing basis; and

• (c) whether the information is disclosed to third parties.

Security Safeguards

• (a) carry out, in accordance with the prescribed requirements, a privacy impact assessment; and

• (b) implement measures to mitigate the risks identified in the privacy impact assessment, such as contractual privacy protection measures, adherence to a code of practice or certification process approved by the Division or any other prescribed measures.

• (a) the sensitivity of the personal information involved in the breach;

• (b) the probability that the personal information has been, is being or will be misused; and

• (c) any other prescribed factor.

Openness and Transparency

• (a) a description of the type of personal information under the organization’s control;

• (b) a general account of how the organization uses the personal information and of how it applies the exceptions to the requirement to obtain an individual’s consent under this Act, including a description of any activities referred to in subsection 18(3) in which it has a legitimate interest;

• (c) a general account of the organization’s use of any automated decision system to make predictions, recommendations or decisions about individuals that could have a legal or similarly significant effect on them;

• (d) whether or not the organization transfers or discloses personal information interprovincially or outside of Canada that may have reasonably foreseeable privacy implications;

• (e) the retention periods applicable to sensitive personal information;

• (f) how an individual may make a request for disposal under section 54 or access under section 63; and

• (g) the business contact information of the individual to whom complaints or requests for information may be made.

Access to and Amendment of Personal Information

• (a) a version of the information already exists in that format; or

• (b) its conversion into that format is reasonable and necessary in order for the individual to be able to exercise their rights under this Act.

• (a) for a maximum of 30 days if

  • (i) meeting the time limit would unreasonably interfere with the activities of the organization, or

  • (ii) the time required to undertake any consultations necessary to respond to the request would make the time limit impracticable to meet; or

• (b) for the period that is necessary in order to be able to convert the personal information into an alternative format.

In either case, the organization must, no later than 30 days after the day on which the request was received, send a notice of extension to the individual, advising them of the new time limit, the reasons for extending the time limit and their right to make a complaint to the Commissioner in respect of the extension.

• (a) the organization has informed the individual of the approximate cost;

• (b) the cost to the individual is minimal; and

• (c) the individual has advised the organization that the request is not being withdrawn.

• (a) inform the individual about

  • (i) any disclosure to a government institution or a part of a government institution under section 43, 44 or 45, subsection 46(1) or 47(1) or section 49, or

  • (ii) the existence of any information that the organization has relating to a disclosure referred to in subparagraph (i), to a subpoena, warrant or order referred to in section 49 or to a request made by a government institution or a part of a government institution under section 43 or subsection 46(1); or

• (b) give the individual access to the information referred to in subparagraph (a)‍(ii).

• (a) must, in writing and without delay, notify the government institution or the part of a government institution concerned of the request made by the individual; and

• (b) must not respond to the request before the earlier of

  • (i) the day on which it is notified under subsection (5), and

  • (ii) 30 days after the day on which the government institution or the part of a government institution is notified.

• (a) national security, the defence of Canada or the conduct of international affairs;

• (b) the detection, prevention or deterrence of money laundering or the financing of terrorist activities; or

• (c) the enforcement of federal or provincial law or law of a foreign jurisdiction, an investigation relating to the enforcement of any such law or the gathering of intelligence for the purpose of enforcing any such law.

• (a) must refuse the request to the extent that it relates to paragraph (3)‍(a) or to information referred to in subparagraph (3)‍(a)‍(ii);

• (b) must notify the Commission, in writing and without delay, of the refusal;

• (c) must not give the individual access to any information that the organization has relating to a disclosure to a government institution or a part of a government institution under section 43, 44 or 45, subsection 46(1) or 47(1) or section 49 or to a request made by a government institution or part of a government institution under section 43 or subsection 46(1);

• (d) must not provide to the individual the name of the government institution or part of a government institution to which the disclosure was made or its type; and

• (e) must not disclose to the individual the fact that the organization notified an institution or part of an institution under paragraph (4)‍(a), that the institution or part of an institution objects or that the Commission was notified under paragraph (b).

• (a) the information is protected by solicitor-client privilege or the professional secrecy of advocates and notaries or by litigation privilege;

• (b) to do so would reveal confidential commercial information;

• (c) to do so could reasonably be expected to threaten the life or security of another individual;

• (d) the information was collected under subsection 38(1);

• (e) the information was generated in the course of a formal dispute resolution process; or

• (f) the information was created for the purpose of making a disclosure under the Public Servants Disclosure Protection Act or in the course of an investigation into a disclosure under that Act.

However, in the circumstances described in paragraph (b) or (c), if giving access to the information would reveal confidential commercial information or could reasonably be expected to threaten the life or security of another individual, as the case may be, and that information is severable from any other information for which access is requested without imposing an undue burden on the organization, the organization must give the individual access after severing.

Mobility of Personal Information

Challenging Compliance

De-identification of Personal Information

• (a) consider, when applying technical and administrative measures to the information, the risk of an individual being identified; and

• (b) ensure that those measures are proportionate to the purpose for which the information is de-identified and the sensitivity of the personal information.

• (a) to conduct testing of the effectiveness of security safeguards that it has put in place;

• (b) in circumstances where the personal information was de-identified solely for the purpose of protecting the information;

• (c) in circumstances where the organization obtains the individual’s valid consent;

• (d) in circumstances where an exception in respect of the use of an individual’s personal information set out in section 18, 23, 24 or 26, subsection 27(2) or 29(2), section 30, subsection 38(2) or section 50 applies;

• (e) in circumstances where the personal information is used solely for the purpose of anonymizing it under section 20;

• (f) to comply with any requirements under this Act or under federal or provincial law;

• (g) to conduct testing of the fairness and accuracy of models, processes and systems that were developed using de-identified personal information;

• (h) to conduct testing of the effectiveness of its de-identification processes;

• (i) for a purpose or situation authorized by the Division under section 138; and

• (j) in any other prescribed circumstances.

PART 2 

Commission, Commissioner and Division

Commission

• (a) disclose to the Commissioner of Competition, under an agreement or arrangement entered into under section 80, information that relates to an entity that operates an approved certification program or an organization that is certified under an approved certification program;

• (b) consult with federal government institutions respecting codes of practice or certification programs; and

• (c) in the form and manner that the Commission considers appropriate,

  • (i) develop and conduct information programs to foster public understanding of this Act and its purposes,

  • (ii) develop guidance materials and tools for organizations in relation to their compliance with this Act — including any guidance materials and tools that are requested by the Minister — in consultation with stakeholders, including any relevant federal government institutions,

  • (iii) undertake and publish research in relation to the protection of personal information, including any research that is requested by the Minister,

  • (iv) undertake and publish any research in relation to the operation or implementation of this Act that is requested by the Minister,

  • (v) on request by an organization, provide guidance on — and, if the Commission considers it appropriate, recommend corrective measures in relation to — its privacy management program, and

  • (vi) promote, by any other means that the Commission considers appropriate, the purpose of this Act.

• (a) the purpose of this Act;

• (b) the size and revenue of organizations;

• (c) the volume of the personal information under the control of organizations and the sensitivity of that information;

• (d) the best interests of children;

• (e) the importance of respecting Canada’s international trade obligations;

• (f) the importance of supporting economic growth, competition and innovation in the Canadian marketplace; and

• (g) any other matter of general public interest.

• (a) the decision to initiate a complaint under subsection 97(2);

• (b) the handling of complaints, including the decision as to whether to initiate or discontinue an investigation and the conduct of proceedings in respect of an application referred to in section 109 or an interim order referred to in subsection 123(4);

• (c) the dispute resolution mechanisms referred to in section 101;

• (d) the compliance agreements referred to in section 102 and 103;

• (e) the proposed orders referred to in subsections 107(3) and 108(3) and compliance orders referred to in subsection 110(1);

• (f) the administrative monetary penalty scheme; and

• (g) the audits referred to in section 118.

• (a) coordinate the activities of their respective offices, including providing for mechanisms for handling complaints of mutual interest;

• (b) undertake and publish research on issues of mutual interest; and

• (c) develop procedures for disclosing information referred to in subsection (2).

The Commission must, if the Commission considers it appropriate to do so, carry out those objectives in a manner that promotes regulatory consistency.

• (a) restrict the use of the information to the purpose for which it was originally disclosed; and

• (b) stipulate that the information be treated in a confidential manner and that it not be further disclosed without the express consent of the Commission.

• (a) coordinate the activities of their respective offices, including providing for mechanisms for handling complaints in which they are mutually interested;

• (b) undertake and publish research, or develop and publish guidelines or other documents, related to the protection of personal information;

• (c) develop model contracts or other documents related to the protection of personal information that is collected, used or disclosed interprovincially or internationally; and

• (d) develop procedures for disclosing information referred to in subsection (3).

• (a) could be relevant to the — ongoing or potential — investigation of a complaint, proceeding in respect of an application referred to in section 109, proceeding in respect of an interim order referred to in subsection 123(4) or audit carried out under this Act or provincial legislation that has objectives that are similar to this Act; or

• (b) could assist that person, the Commission, the Commissioner or the Division in the exercise of their powers or the performance of their duties or functions with respect to the protection of personal information.

• (a) restrict the use of the information to the purpose for which it was originally disclosed; and

• (b) stipulate that the information be treated in a confidential manner and that it not be further disclosed without the express consent of the Commission.

• (a) powers, duties and functions similar to those of the Commission, Commissioner or Division with respect to the protection of personal information; or

• (b) responsibilities that relate to conduct that is substantially similar to conduct that would be in contravention of this Act.

• (a) could be relevant to an — ongoing or potential — investigation or proceeding in respect of a contravention of the laws of a foreign state that address conduct that is substantially similar to conduct that would be in contravention of this Act; or

• (b) is necessary to disclose in order to obtain from the person or body information that could be relevant to an — ongoing or potential — investigation, proceeding in respect of an application referred to in section 109, proceeding in respect of an interim order referred to in subsection 123(4) or audit carried out under this Act.

• (a) limits the disclosure of information to what is necessary for the purpose set out in paragraph (2)‍(a) or (b);

• (b) restricts the use of the information to the purpose for which it was originally disclosed; and

• (c) stipulates that the information be treated in a confidential manner and that it not be further disclosed without the express consent of the Commission.

• (a) provide for cooperation with respect to the enforcement of laws protecting personal information, including the disclosure of information referred to in subsection (2) and the provision of mechanisms for handling complaints of mutual interest;

• (b) develop procedures for disclosing information referred to in subsection (2);

• (c) develop recommendations, resolutions, rules, standards or other documents with respect to the protection of personal information;

• (d) undertake and publish research related to the protection of personal information;

• (e) share knowledge and expertise by different means, including through staff exchanges; and

• (f) identify issues of mutual interest and determine priorities pertaining to the protection of personal information.

• (a) the exercise of the powers, and the performance of the duties and functions, of the Commission, the Commissioner and the Division under this Act, including in relation to paragraph 76(c), section 77, subsections 78(2) and 80(1) and sections 86 and 90;

• (b) the application of this Act; and

• (c) the extent to which the provinces have enacted legislation that is substantially similar to this Act and the application of any such legislation.

Commissioner

• (a) request that an entity that operates an approved certification program provide the Commissioner with information that relates to the program;

• (b) cooperate with an entity that operates an approved certification program for the purpose of the exercise of the Commissioner’s powers, and the performance of their duties and functions, under this Act;

• (c) in the circumstances and according to the criteria set out in the regulations, recommend, in accordance with the regulations, to an entity that operates an approved certification program that an organization’s certification be withdrawn if the Commissioner is of the opinion that the organization is not in compliance with the requirements of the program; and

• (d) in accordance with the regulations, revoke an approval of a certification program in the circumstances and according to the criteria set out in the regulations.

• (a) the purpose of this Act;

• (b) the size and revenue of organizations;

• (c) the volume of the personal information under the control of organizations and the sensitivity of that information;

• (d) the best interests of children;

• (e) the importance of respecting Canada’s international trade obligations;

• (f) the importance of supporting economic growth, competition and innovation in the Canadian marketplace; and

• (g) any other matter of general public interest.

• (a) to any employee of the Commission; and

• (b) with the consent of the Chairperson, to the Division, a division of the Commission established under section 8 of the Digital Safety and Data Protection Commission of Canada Act or one or more other members of the Commission.

Division

• (a) the purpose of this Act;

• (b) the size and revenue of organizations;

• (c) the volume and sensitivity of the personal information under the control of organizations;

• (d) the best interests of children;

• (e) the importance of respecting Canada’s international trade obligations;

• (f) the importance of supporting economic growth, competition and innovation in the Canadian marketplace; and

• (g) any other matter of general public interest.

Codes of Practice and Certification Programs

• (a) a code of practice that provides for substantially the same or greater protection of personal information as some or all of the protection provided under this Act;

• (b) guidelines for interpreting and implementing the code of practice;

• (c) a mechanism by which an entity that operates the program may certify that an organization is in compliance with the code of practice;

• (d) a mechanism for the independent verification of an organization’s compliance with the code of practice;

• (e) disciplinary measures for non-compliance with the code of practice by an organization, including the revocation of an organization’s certification; and

• (f) anything else that is provided in the regulations.

Remedies

• (a) the complainant should first exhaust grievance or review procedures otherwise reasonably available;

• (b) the complaint could more appropriately be dealt with, initially or completely, by means of a procedure provided for under any federal law, other than this Act, or provincial law;

• (c) the complaint was not filed within a reasonable period after the day on which the subject matter of the complaint arose;

• (d) the complaint raises an issue in respect of which a certification program that was approved by the Division under subsection 93(2) applies and the organization is certified under that program;

• (e) there is insufficient evidence to pursue the investigation;

• (f) the complaint is trivial, frivolous or vexatious or is made in bad faith;

• (g) the organization has provided a fair and reasonable response to the complaint;

• (h) the matter is already the subject of an ongoing investigation under this Act or proceeding in respect of an application referred to in section 109 or interim order referred to in subsection 123(4);

• (i) the matter has already been the subject of a report or decision by the Commission or Commissioner, as the case may be;

• (j) the matter is being or has already been addressed under a procedure referred to in paragraph (a) or (b);

• (k) the matter is the subject of a compliance agreement referred to in subsection 102(1) or 103(2);

• (l) an investigation or any further investigation is unnecessary having regard to all the circumstances of the complaint; or

• (m) a notice of contravention was served on the organization in relation to the matter or to any act referred to in the complaint.

• (a) the facts of the alleged contravention and the Commissioner’s reasons for believing there is a contravention;

• (b) the provisions of this Act that have been contravened;

• (c) the penalty, if any, that the organization is liable to pay and the time and manner in which the penalty must be paid;

• (d) the proposed order, if any, that the Commissioner considers reasonably necessary to ensure compliance with this Act and the Commissioner’s reasons for it;

• (e) a summary of the organization’s rights and obligations under this Act, including the right to apply for a review and to make representations to the Commission under section 109 within 30 days after the day on which the notice is served, or within any further period set out in the notice, and the procedure for doing so;

• (f) the fact that, if the organization does not pay the penalty, if any, in accordance with the notice or if neither the complainant nor the organization exercise the remedies referred to in section 109, the organization will be deemed to have contravened the provisions at issue; and

• (g) the fact that if neither the complainant nor the organization exercise the remedies referred to in section 109 in relation to a proposed order, the organization will be deemed to have contravened the provisions at issue and the proposed order will be made by the Commission.

• (a) take any measure necessary in order to comply with this Act;

• (b) cease any act that contravenes this Act; and

• (c) make public anything done or planned to be done to correct policies, practices or procedures that it put in place to comply with its obligations under this Act.

• (a) the facts of the alleged non-compliance with the compliance agreement and the Commissioner’s reasons for believing there is non-compliance;

• (b) the provisions of this Act that have been contravened;

• (c) the penalty, if any, that the organization is liable to pay and the time and manner in which the penalty must be paid;

• (d) the proposed order, if any, that the Commissioner considers reasonably necessary to ensure compliance with this Act and the Commissioner’s reasons for it;

• (e) a summary of the organization’s rights and obligations under this Act, including the right to apply for a review and to make representations to the Commission under section 109 within 30 days after the day on which the notice is served, or within any further period set out in the notice, and the procedure for doing so;

• (f) the fact that, if the organization does not pay the penalty, if any, in accordance with the notice or if neither the complainant nor the organization exercise the remedies referred to in section 109, the organization will be deemed to have contravened the provisions at issue or to have not complied with the compliance agreement; and

• (g) the fact that if neither the complainant nor the organization exercise the remedies referred to in section 109 in relation to a proposed order, the organization will be deemed to have contravened the provisions at issue or to have not complied with the compliance agreement and the proposed order will be made by the Commission.

• (a) take any measure necessary in order to comply with this Act;

• (b) cease any act that contravenes this Act;

• (c) comply with the compliance agreement that the organization entered into; and

• (d) make public anything done or planned to be done to correct policies, practices or procedures that it put in place to comply with its obligations under this Act.

• (a) take any measure necessary in order to comply with this Act;

• (b) cease any act that contravenes this Act;

• (c) comply with a compliance agreement that the organization entered into; and

• (d) make public anything done or planned to be done to correct policies, practices or procedures that it put in place to comply with its obligations under this Act.

• (a) subsection 9(1);

• (b) subsection 11(1);

• (c) subsections 12(1), (3) and (4);

• (d) section 13;

• (e) subsection 14(1);

• (f) subsections 15(1) and (7);

• (g) section 16;

• (h) subsection 17(2);

• (i) section 52;

• (j) subsections 54(1) and (5);

• (k) subsection 56(1);

• (l) subsections 58(1) and (3);

• (m) section 61; and

• (n) subsection 62(1).

• (a) the nature and scope of the contravention;

• (b) any evidence that the organization exercised due diligence to avoid the contravention;

• (c) whether the organization made reasonable efforts to mitigate or reverse the contravention’s effects;

• (d) the organization’s history of compliance with this Act;

• (e) the organization’s ability to pay the penalty and the likely effect that paying it would have on the organization’s ability to carry on its business;

• (f) any financial benefit that the organization obtained from the contravention;

• (g) any prescribed factor; and

• (h) any other relevant factor.

• (a) at the time of the contravention of the provision in question, the organization was in compliance with the requirements of a certification program that was in relation to that provision and was approved by the Division under subsection 93(2);

• (b) a prosecution for the act or omission that constitutes the contravention has been instituted against the organization; or

• (c) the organization establishes that it exercised due diligence to prevent the contravention.

• (a) the amount of any penalty set out in a notice of contravention, beginning on the day on which it is required to be paid in accordance with the notice, unless an application for a review is made under section 109 in the time and manner set out in the notice or a compliance agreement has been entered into under section 103;

• (b) if an application referred to in paragraph (a) is made,

  • (i) the amount of any penalty set out in the Commission’s decision, beginning on the day on which it is required to be paid in accordance with the decision, if the decision changes the amount of a penalty set out in the notice of contravention, or

  • (ii) if the decision does not change any such amount, the amount of any penalty set out in the notice of contravention, beginning on the day specified in the Commission’s decision;

• (c) if the Commission’s decision is appealed under section 126,

  • (i) the amount of any penalty set out in the decision of the Federal Court, beginning on the day on which it is required to be paid in accordance with that decision, if that decision changes the amount of a penalty set out in the Commission’s decision, or

  • (ii) if the decision of the Federal Court does not change any such amount, the amount of any penalty set out in the Commission’s decision, beginning on the day specified in the Court’s decision; and

• (d) if the decision of the Federal Court is appealed, the amount of the penalty, if any, set out in the final decision after all rights of appeal have been exhausted.

• (a) summon and enforce the appearance of persons before the Commission and compel them to give oral or written evidence on oath and to produce any records and things that the Commission considers necessary for the purposes of the proceedings, in the same manner and to the same extent as a superior court of record;

• (b) administer oaths;

• (c) receive and accept any evidence and other information, whether on oath, by affidavit or otherwise, that the Commission sees fit, whether or not it is or would be admissible in a court of law;

• (d) order an organization that has information that is relevant to the proceedings to retain the information for as long as is necessary to allow the Commission to complete the proceedings;

• (e) at any reasonable time, enter any premises, other than a dwelling-house, occupied by an organization on satisfying the organization’s security requirements for the premises;

• (f) converse in private with any person in any premises entered under paragraph (e) and otherwise make any inquiries in those premises that the Commission sees fit; and

• (g) examine or obtain copies of, or extracts from, records that are found in any premises entered under paragraph (e) and that contain any matter relevant to the proceedings.

• (a) summon and enforce the appearance of persons before the Commissioner and compel them to give oral or written evidence on oath and to produce any records and things that the Commissioner considers necessary to carry out the investigation or audit, in the same manner and to the same extent as a superior court of record;

• (b) administer oaths;

• (c) receive and accept any evidence and other information, whether on oath, by affidavit or otherwise, that the Commissioner sees fit, whether or not it is or would be admissible in a court of law;

• (d) in exigent circumstances, issue a notice of proposed interim order;

• (e) order an organization that has information that is relevant to the investigation or audit to retain the information for as long as is necessary to allow the Commissioner to carry out the investigation or audit;

• (f) at any reasonable time, enter any premises, other than a dwelling-house, occupied by an organization on satisfying any security requirements of the organization relating to the premises;

• (g) converse in private with any person in any premises entered under paragraph (f) and otherwise make any inquiries in those premises that the Commissioner sees fit; and

• (h) examine or obtain copies of or extracts from records found in any premises entered under paragraph (f) that contain any matter relevant to the investigation or audit.

• (a) the proposed interim order;

• (b) the reasons for the proposed order;

• (c) the right of the organization and of the complainant to make representations to the Commission within 10 days after the day on which the notice is served, or within any further period set out in the notice, and the procedure for doing so; and

• (d) the fact that, if representations are not made in accordance with the notice, the proposed order will be imposed.

• (a) a decision made under subsection 110(1);

• (b) an order made under that subsection; or

• (c) a decision made under that subsection to change the amount of the penalty.

• (a) that an award is necessary to maintain the public’s confidence in the administration of justice; or

• (b) that the absence of an award would have a substantial adverse effect on the other party’s ability to carry on business.

• (a) the Commissioner has made a finding under subsection 105(1) or section 106 that the organization has contravened this Act and

  • (i) the organization has paid the penalty and subsection 107(4) or 108(4) apply, as the case may be,

  • (ii) the finding is not the subject of an application for review under section 109 and the time limit for applying for a review set out in a notice of contravention has expired,

  • (iii) the Commission has confirmed or varied the finding under subsection 110(1),

  • (iv) the finding is not appealed and the time limit for making an appeal under subsection 126(2) has expired, or

  • (v) the Federal Court has dismissed an appeal of the finding under section 128;

• (b) the Federal Court has made a finding under section 128 that the organization has contravened this Act;

• (c) a final decision dismissing any appeal of the finding, or confirming the finding that the organization has contravened this Act, has been made and all rights of appeal have been exhausted; or

• (d) the Commissioner has entered into a compliance agreement with the organization under section 103 and the agreement does not provide for the payment of damages for that loss or injury.

• (a) in the case of an action under subsection (1),

  • (i) the Commissioner’s finding,

  • (ii) if there is a review under section 109, the decision of the Commission, or

  • (iii) if there is an appeal, the final decision after all rights of appeal have been exhausted; and

• (b) in the case of an action under subsection (2), the conviction.

Certificate Under Canada Evidence Act

• (a) all proceedings under this Act in respect of that information, including an investigation, proceeding in respect of an application referred to in section 109, proceeding in respect of an interim order referred to in subsection 123(4), audit, appeal or judicial review, are discontinued;

• (b) the Commission, the Commissioner or the Division must not disclose the information and must take all necessary precautions to prevent its disclosure; and

• (c) the Commission, the Commissioner and the Division must, within 10 days after the day on which the certificate is published in the Canada Gazette, return the information to the organization that provided the information.

• (a) carry out an investigation or audit under this Act, consider an application referred to in section 109 or hear a matter referred to in subsection 123(1); or

• (b) establish the grounds for findings and recommendations contained in any decision or report made under this Act.

• (a) a prosecution for an offence under section 145;

• (b) a prosecution for an offence under section 132 of the Criminal Code (perjury) in respect of a statement made under this Act; or

• (c) a proceeding or an appeal before the Federal Court under this Act.

• (a) a prosecution for an offence under section 145;

• (b) a prosecution for an offence under section 132 of the Criminal Code (perjury) in respect of a statement made under this Act; or

• (c) a proceeding or an appeal before the Federal Court under this Act.

• (a) anything said, any information supplied or any record or thing produced in good faith in the course of an investigation or audit carried out, or proceedings in respect of an application referred to in section 109 or interim order referred to in subsection 123(4), conducted by or on behalf of the Commission, the Commissioner or the Division under this Act; and

• (b) any report or decision made in good faith by the Commission, the Commissioner or the Division under this Act and any fair and accurate account of the report or decision made in good faith for the purpose of news reporting.

General

• (a) respecting the anonymization of personal information;

• (b) respecting the scope of any of the activities set out in paragraphs 18(2)‍(a) to (c), including specifying activities that are not business activities for the purposes of subsection 18(1);

• (c) specifying what is a government institution or part of a government institution for the purposes of any provision of this Act;

• (d) specifying information for the purposes of section 50;

• (e) respecting the disposal of personal information for the purposes of section 54;

• (f) respecting security safeguards for the purposes of section 56;

• (g) specifying information to be kept and maintained under subsection 60(1);

• (h) respecting an individual’s right of access to their personal information; and

• (i) prescribing anything that by this Act is to be prescribed.

• (a) provide that this Act is binding on any agent of His Majesty in right of Canada to which the Privacy Act does not apply;

• (b) if satisfied that legislation of a province that is substantially similar to this Act applies to an organization, a class of organizations, an activity or a class of activities, exempt the organization, activity or class from the application of this Act in respect of the collection, use or disclosure of personal information that occurs within that province; and

• (c) amend the schedule by adding or deleting, in column 1, the name of an organization or by adding or deleting, in column 2, the description of personal information in relation to an organization in column 1.

• (a) criteria that are to be applied in making a determination under paragraph (2)‍(b) that provincial legislation is substantially similar to this Act, or in reconsidering that determination; and

• (b) the process for making or reconsidering that determination.

• (a) respecting data mobility frameworks and prescribing

  • (i) safeguards that must be put in place by organizations to enable the secure disclosure of personal information under section 72 and the secure collection of that information, and

  • (ii) parameters for the technical means for ensuring interoperability in respect of the disclosure and collection of that information;

• (b) specifying organizations that are subject to a data mobility framework; and

• (c) providing for exceptions to the requirement to disclose personal information, including exceptions related to the protection of proprietary or confidential commercial information.

• (a) respecting the criteria for and the manner and the circumstances in which a recommendation may be made under paragraph 85(2)‍(c);

• (b) respecting the criteria for and the manner and the circumstances in which an approval may be revoked under paragraph 85(2)‍(d);

• (c) respecting the making of an application under subsection 92(2);

• (d) setting out criteria for the purposes of subsection 92(3);

• (e) respecting the reconsideration of a determination made under subsection 92(3);

• (f) respecting the making of an application under subsection 93(1);

• (g) providing for anything else that must be included in a certification program for the purposes of paragraph 93(1)‍(f);

• (h) setting out criteria for the purposes of subsection 93(2);

• (i) respecting the reconsideration of a determination made under subsection 93(2);

• (j) specifying, for the purposes of section 94, the time for responding to an application; and

• (k) respecting record-keeping and reporting obligations of an entity that operates an approved certification program, including obligations to provide reports to the Commission in respect of an approved certification program.

• (a) the employee, acting in good faith and on the basis of reasonable belief, has disclosed to the Commission that the employer or any other person has contravened or intends to contravene Part 1;

• (b) the employee, acting in good faith and on the basis of reasonable belief, has refused or stated an intention of refusing to do anything that is a contravention of Part 1;

• (c) the employee, acting in good faith and on the basis of reasonable belief, has done or stated an intention of doing anything that is required to be done in order that Part 1 not be contravened; or

• (d) the employer believes that the employee will do anything referred to in paragraph (a), (b) or (c).

• (a) guilty of an indictable offence and liable to a fine not exceeding the greater of $25,000,000 and 5% of the organization’s gross global revenue in its financial year before the one in which the organization is sentenced; or

• (b) guilty of an offence punishable on summary conviction and liable to a fine not exceeding the greater of $20,000,000 and 4% of the organization’s gross global revenue in its financial year before the one in which the organization is sentenced.

PART 3 

Coming into Force

Order in council

22 A report referred to in subsection 21(1) must not contain personal information, as defined in Insertion start subsection 2(1) Insertion end of the Insertion start Protecting Insertion end Privacy Insertion start and Consumer Data Insertion end Act.

Digital Safety Commission of Canada

Commission canadienne de la sécurité numérique

Digital Safety Insertion start and Data Protection Insertion end Commission of Canada

Commission canadienne de la sécurité numérique Insertion start et de la protection des données Insertion end

Digital Safety Commission of Canada

Commission canadienne de la sécurité numérique

Digital Safety Insertion start and Data Protection Insertion end Commission of Canada

Commission canadienne de la sécurité numérique Insertion start et de la protection des données Insertion end

Digital Safety Commission of Canada

Commission canadienne de la sécurité numérique

Digital Safety Insertion start and Data Protection Insertion end Commission of Canada

Commission canadienne de la sécurité numérique Insertion start et de la protection des données Insertion end

Digital Safety Commission of Canada

Commission canadienne de la sécurité numérique

Digital Safety Insertion start and Data Protection Insertion end Commission of Canada

Commission canadienne de la sécurité numérique Insertion start et de la protection des données Insertion end

Digital Safety Commission of Canada

Commission canadienne de la sécurité numérique

Digital Safety Insertion start and Data Protection Insertion end Commission of Canada

Commission canadienne de la sécurité numérique Insertion start et de la protection des données Insertion end

Digital Safety Commission of Canada

Commission canadienne de la sécurité numérique

Digital Safety Insertion start and Data Protection Insertion end Commission of Canada

Commission canadienne de la sécurité numérique Insertion start et de la protection des données Insertion end

Personal Information Protection and Electronic Documents Act

Loi sur la protection des renseignements personnels et les documents électroniques

Start of inserted block

Protecting Privacy and Consumer Data Act

Loi visant à protéger la vie privée et les données des consommateurs

End of inserted block

4.‍83 (1) Despite Insertion start Part 1 Insertion end of the Insertion start Protecting Privacy Insertion end and Insertion start Consumer Data Insertion end Act, to the extent that that Insertion start Part Insertion end relates to obligations relating to the disclosure of information, an operator of an aircraft departing from Canada that is due to land in a foreign state or fly over the United States and land outside Canada or of a Canadian aircraft departing from any place outside Canada that is due to land in a foreign state or fly over the United States may, in accordance with the regulations, provide to a competent authority in that foreign state any information that is in the operator’s control relating to persons on board or expected to be on board the aircraft and that is required by the laws of the foreign state.

14 The Insertion start Digital Safety and Data Protection Commission of Canada Insertion end , for the purposes of the Insertion start Protecting Privacy Insertion end and Insertion start Consumer Data Insertion end Act

17 A judge of the Federal Court, for the Insertion start purposes Insertion end of the Insertion start Protecting Privacy Insertion end and Insertion start Consumer Data Insertion end Act

12.‍1 (1) The Commission may enter into an agreement or arrangement with the Digital Safety and Data Protection Commission of Canada in order to

(2) The Commission may, in accordance with any procedure established under paragraph (1)‍(c), disclose information to the Digital Safety and Data Protection Commission of Canada if the information is relevant to its powers, duties or functions under the Protecting Privacy and Consumer Data Act.

(3) The procedures referred to in paragraph (1)‍(c) shall

29.‍3 (1) Despite subsection 29(1), the Commissioner may enter into an agreement or arrangement with the Digital Safety and Data Protection Commission of Canada in order to

(2) The Commissioner may, in accordance with any procedure established under paragraph (1)‍(c), disclose information to the Digital Safety and Data Protection Commission of Canada if the information is relevant to its powers, duties or functions under the Protecting Privacy and Consumer Data Act.

(3) The procedures referred to in paragraph (1)‍(c) shall

(5) Within one year after the sixth anniversary of the day on which an individual ceases to be an individual with significant control over the corporation, the corporation shall — subject to any other Act of Parliament and to any Act of the legislature of a province that provides for a longer retention period — dispose of any of that individual’s personal information, as defined in subsection 2(1) of the Insertion start Protecting Privacy Insertion end and Insertion start Consumer Data Insertion end Act, that is recorded in the register.

(4) A company that collects, uses or communicates information under this section, section 17.‍31 or 17.‍94, subsection 28(1.‍1) or 36(2) or regulations made under section 17.‍95 may do so

(2) Subject to subsections (4) Insertion start to (5.‍1) Insertion end and (7), if a person designates information as confidential and the designation is not withdrawn by that person, no person described in subsection (3) shall knowingly disclose the information, or knowingly allow it to be disclosed, to any other person in any manner that is intended or likely to make it available for the use of any person who may benefit from the information or use it to the detriment of any person to whose business or affairs the information relates.

(5.‍1) The Commission may disclose designated information obtained by it in the exercise of its powers or the performance of its duties or functions under this Act to the Digital Safety and Data Protection Commission of Canada in accordance with section 12.‍1 of the Canadian Radio-television and Telecommunications Commission Act.

(2) Subject to subsections (4), (5) and (5.‍1) Insertion start to Insertion end (6), Insertion start if Insertion end a person designates information as confidential and the designation is not withdrawn by that person, no person described in subsection (3) shall knowingly disclose the information, or knowingly allow it to be disclosed, to any other person in any manner that is calculated or likely to make it available for the use of any person who may benefit from the information or use the information to the detriment of any person to whose business or affairs the information relates.