Publication
Avoiding legal and regulatory pitfalls in digital transformation projects
This article first appeared in the September 2024 issue of Financier Worldwide.
Author:
Canada | Publication | August 4, 2021
Given global trends in the development of privacy laws and enforcement, Canada and several provinces are looking at modernizing their respective privacy regimes. Ontario’s new proposed privacy law, which would govern commercial activities more broadly than current legislation (i.e., our federal legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA), and Ontario’s health privacy legislation, the Personal Health Information Protection Act (PHIPA)), is intended to enhance the public’s confidence in Ontario’s digital economy by recognizing individuals’ fundamental right to privacy and imposing strict compliance obligations and financial penalties on organizations doing business in Ontario.
On June 17, 2021, the Government of Ontario released a white paper outlining its proposals and requesting public feedback. It suggests that the proposed new legislation would be in addition to PHIPA. This was partially in response to Bill C-11 (the federal government’s new proposed private sector privacy legislation), which even the Privacy Commissioner of Canada described as “a step back overall from our current law” and as requiring “significant changes if confidence in the digital economy is to be restored.” The white paper outlines proposals that aim to:
In this update, we will elaborate on proposals 1 through 3. We will provide more detail on proposals 4 through 7 in a subsequent update.
Rights-based approach to privacy. The following proposals were put forward with a view to implementing a rights-based approach to privacy laws:
Placing individuals’ fundamental right to privacy at the centre of the discussion encourages organizations to design their privacy policies and practices around this very important concept. By reimaging the definition of “sensitive” personal information, taking a “less is more” approach to collecting data, restricting legitimate purposes of collection to those that are fair and appropriate, and prioritizing individuals’ control over the disposal and movement of their data, the Ontario government appears committed to enshrining the fundamental right to privacy in its proposed legislation.
AI and Automated decision-making technologies. The following proposals were put forward to ensure the safe and transparent use of AI and automated decision-making technologies:
The expanded use of AI and automated decision-making technologies constitutes important progress and innovation, but also has a potential dark side – these technologies make it possible to cause significant harm to individuals, because of heightened risks of surveillance and algorithmic bias. With so many diverse and extensive bodies of data available to organizations using these technologies, the Ontario government is aiming to enhance transparency, so that individuals may be empowered to understand and make meaningful decisions about their online profiles.
Consent and lawful use. The following proposals were put forward to enhance the process of obtaining consent, and restrict uses of personal information to those uses that are lawful:
Consent fatigue in today’s day and age is very real, therefore the Ontario government is prioritizing the development of new and engaging ways for individuals to provide consent and participate in governing their personal information. A “one size fits all” approach to consent is not practical. Drawing a clear line between what organizations can and cannot do as a matter of convenience is an important first step, but the Ontario government acknowledges much work remains in terms of designing these novel and effective approaches to obtaining meaningful consent.
For several years now, Ontario has been a hotbed for innovation, triggering rumblings about Ontario becoming the “Silicon Valley of the North.” To that end, it is critical for Ontario to embrace its responsibility and potential to become a world-class jurisdiction for data protection and the digital economy.
The authors would like to thank Katie Helou, summer student, for her contribution to this legal update.
Publication
This article first appeared in the September 2024 issue of Financier Worldwide.
Publication
The Digital Markets, Competition and Consumers Act (DMCC Act) received Royal Assent on 24 May 2024 and is generally expected to come into force in autumn this year.
Publication
On 26 July 2024, the People’s Bank of China (PBOC) and the State Administration of Foreign Exchange (SAFE) jointly released revised rules in respect of the investments into China’s financial market through the Qualified Foreign Institutional Investor and Renminbi Qualified Foreign Institutional Investor (collectively, QFII) regime (the New Rules).
Subscribe and stay up to date with the latest legal news, information and events . . .
© Norton Rose Fulbright LLP 2023