Ontario Seeks to Improve Private Sector Privacy Protection

Private sector businesses in Ontario and across Canada had a major overhaul with respect to how they protect the private data they collect when the federal Personal Information Protection and Electronic Documents Act (PIPEDA) was enacted in 2004. Since then, personal privacy has become a more significant concern as more and more businesses have moved to online services involving the electronic collection of personal data. Over the past few years, a number of private sector businesses have also been compromised by third parties who have been able to access the private data of customers, patients and employees, leaving people feeling more vulnerable than ever when it comes to the security of their personal information. In response, the province is looking to strengthen existing privacy laws for private sector businesses and is seeking input from the public and from organizations on how to do so.

Changes Under PIPEDA

When PIPEDA came into effect, businesses were required to conduct a self-assessment with respect to key data collection, use and storage practices to ensure they complied with the new law. Primarily, PIPEDA required all businesses adopt the following practices with respect to personal data, if they hadn’t already:

• obtain the clear consent of an individual before collecting, using or disclosing personal information about that individual;
• use the information only for the purposes for which consent has been obtained;
• protect the information from unauthorized access and use;
• keep the information up to date and correctly filed so that decisions are based on correct information;
• destroy the information when it is no longer needed for the original purpose, and
• implement accountability mechanisms to ensure compliance with the above.

“Personal data” can mean any information relating to an identifiable individual including date of birth, credit history, address, telephone number and more.

Province Seeking Input on Privacy Improvements

As a preliminary step in how best to improve current privacy and access to information practices in the province, the Ontario government is seeking feedback and input from citizens, technology experts and business stakeholders in how to:

• address gaps in the existing legislation
• put in place comprehensive, up-to-date and robust rules that will protect privacy rights and increase confidence in digital services
• help Ontarians be better informed about how their personal information is used, and what they are agreeing to when providing it
• enable people with the ability to withdraw consent and retrieve their data more easily
• create more certainty that Ontario’s businesses will uphold individuals’ privacy even in the use of new technologies and digital business models

Currently, the province is considering a number of changes affecting both individuals and businesses. Included in those proposals are:

1. Increasing transparency with respect to how personal information is used by the organizations that collect it.
2. Enabling individuals to revoke consent more easily with respect to the use of their personal information, and requiring businesses to adopt an “opt-in” model with respect to any secondary uses of that data, in order to ensure active consent.
3. Allowing individuals the ability to request that companies erase any of their personal data when possible.
4. Increasing the enforcement powers of the provincial Privacy Commissioner to ensure compliance and impose penalties on businesses when needed.

These are just some of the proposed changes, which could have a significant impact on how businesses collect, store and use private data. In many cases, these changes will require a business to completely reassess their current practices and enact new processes for clients, customers and other private individuals to take more control of their data, even after it’s collected.

The provincial government is accepting feedback, suggestions and input from all Ontarians, including affected stakeholders such as Ontario businesses, until October 1st. To participate in the process, see more information here.

The skilled business lawyers at GLG LLP in Toronto regularly assist corporate clients with a variety of issues, including the configuration and structure of a venture in a way that is most beneficial to those involved. Further, we advise and represent corporate clients on related matters including commercial real estate ventures, compliance and litigation if necessary. If you are a business owner with concerns related to your obligations and responsibilities under provincial or federal legislation, we can help. Call 416-272-7557 or complete the online form to arrange a consultation with one of our lawyers today.