Leave no Ontarian Behind: Why Ontario should move ahead with its own private sector privacy law with or without federal reform

Information and Privacy Commissioner of Ontario responds to Ontario government’s proposals for a new private sector privacy law

TORONTO, ON (September 7, 2021) — The Office of the Information and Privacy Commissioner of Ontario (IPC) has issued its response to the provincial government’s white paper on proposals for a provincial private sector privacy law that could establish Ontario as a leading digital jurisdiction.

Ontario-based companies continue to be governed by Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA is showing its age, and its proposed replacement, Bill C-11, the Digital Charter Implementation Act, 2020, died on the order paper with the announcement of a September federal election.

But whether or not legislative reform is pursued by the next federal government, Ontarians would be better off with their own private sector privacy law that offers them comprehensive protections entirely beyond the reach of any federal law now or in the future. A provincial statute would expand privacy protection for the millions of Ontarians employed by provincially-regulated companies not covered by federal privacy law. A provincial privacy law could also fill other important constitutional gaps such as charitable organizations, unions, professional associations, and political parties in Ontario.

A new law, tailored to Ontario, has other benefits, particularly for the small and medium-sized businesses that are the backbone of economic activity, comprising over 440,000 employers, 86.4 per cent of the private sector workforce, and 85.3 per cent of our province’s GDP. A made-in-Ontario law could allow for a more agile approach to regulation, one that supports compliance in a manner better suited to the unique experiences and challenges of smaller businesses. With its eyes and ears close to the ground, the IPC is well-equipped to support local organizations by providing practical guidance materials and impactful advisory services that reflect the day-to-day realities of doing business in our province.

Fears about red tape and duplication of privacy laws could be addressed by achieving substantially similar status with the federal law, so that businesses conducting commercial activity within the province would be exempt from PIPEDA, having only to comply with the provincial law in question. For businesses engaged in commercial activity across borders, attention to harmonization could enable interoperability between laws and enforcement cooperation between regulators.

A provincial approach to privacy could also help ensure statutory coordination across multiple sectors, including the private, public, health, and child and youth sectors, providing a more coherent regulatory scheme in which cross-sectoral data initiatives can take hold and flourish for the greater public good. Similarly, a provincial law could be better integrated into Ontario’s overall Digital and Data Strategy, furthering the province’s open data objectives and enabling equitable data sharing in a manner that is digitally secure and respectful of privacy and other human rights.

“Privacy rights in Ontario could be better served and protected with a provincial private sector privacy law that provides enhanced privacy protections and better aligns with our province’s unique values, realities, and culture,” said Patricia Kosseim, Information and Privacy Commissioner of Ontario. “Without a provincial approach to privacy, critical constitutional gaps remain that continue to expose millions of Ontarians to privacy and security risks. A new law has the potential to fuel responsible innovation, support the post-pandemic economic recovery, and provide Ontario’s businesses with the regulatory certainty and compliance support needed to help them grow and prosper as world leaders in the digital space.”

Should Ontario proceed to adopt a provincial privacy sector privacy law, the IPC’s priority will be to develop the foundational building blocks and oversight mechanisms for implementing Ontario’s private sector privacy law in a manner that protects privacy, supports responsible innovation and accords with our province’s unique circumstances and economic reality.

Additional Resources:

• Backgrounder
• Read the IPC’s full submission
• Previous IPC submission to the government’s first consultation, Improving private sector privacy for Ontarians in a digital age (October 2020)
• Opportunity for a privacy law that works for consumers, businesses (Toronto Star)
• Blogs by Commissioner Kosseim
• IPC Strategic Priorities 2021-2025

Media inquiries:
@email