#CyberFLASH: Privacy watchdog wants to see new office enforcement muscle

1297658073661_ORIGINALCanada’s privacy watchdog says “the time has come” to change his role under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) from that of an ombudsman, who can only make non-binding recommendations, to a regulator with authority to make binding orders, and even impose fines on recalcitrant organizations.

In an exclusive interview, federal Privacy Commissioner Daniel Therrien contrasted his limited enforcement powers (“naming and shaming” privacy transgressors and, on occasion, taking them to court) with those of EU and U.S. regulators.

“In many other jurisdictions, privacy regulators have order-making powers and they can impose fines for organizations that violate privacy laws,” Therrien said. “We’ve done well in Canada without these powers, but we think that the time has come to align our laws to those of other western democracies where privacy regulators do have order-making and fine powers. We’re dealing with organizations that are extremely wealthy. To recommend that they change a practice has some effect. But to be able to make an order, and to impose fines, when warranted, I think is necessary.”

The commissioner did not disclose what level of fines he considers appropriate (“we’re not there yet,” he said).

But his endorsement of adding beefed-up enforcement powers to the federal privacy regime — which he considers “an important enhancement” and “not a revolution” — will spark debate.

“I would be quite against…giving the commissioner order-making powers,” privacy law expert David Fraser of McInnes Cooper in Halifax told The Lawyers Weekly. “That would be a revolutionary thing in Canadian privacy law, and actually would require, I think, kind of essentially burning [the office of the privacy commissioner] to the ground and starting again because…if it’s going to have the ability to levy fines, or anything else like that, you have to build in all the procedural fairness requirements. You can’t have a kind of ‘judge-jury-executioner-prosecutor’ all in one office and all in one person, particularly in light of the advocacy-for-privacy role that the commissioner takes.”

Fraser called PIPEDA, as it stands, “a made-in-Canada solution that, in fact, is a complete solution. You have a privacy commissioner whose job…not to an insignificant degree, is framed as a champion of privacy, [who] investigates. The objective is principally to resolve [privacy complaints] and because the commissioner isn’t the cops, and isn’t the judge, at least in my experience, the businesses are inclined to sit down at the table with the commissioner and the commissioner’s investigators, lay all their cards on the table, and look towards building a solution, rather than something that is more adversarial. And so in fact I think all that goodwill would pretty well go out the window, and people would kind of ‘lawyer-up’ in the classic sense. It would get very defensive and it would get very adversarial.”

Read more here

© 2013 CyberTRAX Canada - All Rights Reserved.
Sponsored by C3SA Corp.