Proposed privacy law ‘pretty well balanced,’ Canadian marketers told

Share post:

What was billed by the Canadian Marketing Association as a keynote speech on the Trudeau government’s proposed private-sector privacy legislation by a senior minister turned into a two-minute welcome to the CMA’s annual privacy conference.

Industry Minister François-Philippe Champagne said the proposed Bill C-27, which introduces the Consumer Protection Privacy Act, (CPPA) will “set a new standard when it comes to protecting children’s privacy. Minors and their parents will have more power to control the personal information they share online.”

“As marketers,” he told the online conference, “you are at the forefront of helping people find products and services to make their lives better. I am convinced that this new framework will enable you to work more effectively while also upholding important safeguards for Canadians’ privacy and data. Together we are building a better, safer and more prosperous Canadian economy.”

And after wishing attendees a good conference, his video statement ended.

That left time to reflect on a panel discussion by marketing and legal pros on the possible impact of the CPPA and the proposed Artificial Intelligence Data Act, should they survive their present form.

The legislation is perhaps a year from being implemented. C-27 still has to be debated before a parliamentary committee, which will hear from witnesses, and then go through the Senate. The government will also have to create regulations with some definitions to go along with the legislation.

“The overall positive aspect for both business and marketers is it achieves a balance, and there is flexibility,” said Amanda Maltby, general manager of corporate compliance and regulatory affairs at Canada Post. They will still be able to speak to consumers and to innovate, she added.

Like the current Personal Informational Protection and Electronic Documents Act, the CPPA has a principles-based framework, she said.

And while the Privacy Commissioner would be given new order-making powers, “generally this approach … is something biz and marketers will be able to operate under.”

David Elder, head of the data protection group at the Stikeman Elliot law firm, also described the proposed legislation as “pretty well-balanced.”

While there are exceptions to the need for businesses to get explicit consent from people to capture and use their personal data, he said, these aren’t available if the data is to be used for influencing behaviors or decisions — which is what marketers do. So, Elder concluded, CPPA means “stay the course” for the industry on consent issues.

But, he added, the CPPA would require companies to be more transparent about how automated decision-making applications work. So theoretically, he said, any predictive modeling or a product recommendation engine available to customers might be included.

Sahil Razdan, legal counsel for the Postmedia Network chain of newspapers and websites, noted that the CPPA would allow customers to withdraw their consent for their personal data to be collected by website cookies or other means. Marketers will have to think about data deletion or anonymization strategies, he said.

Under PIPEDA, there has always been the right to withdraw consent, Elder pointed out, but CPPA would make it more explicit.

Elder also noted that under the CPPA, an organization doesn’t have to get explicit consent from individuals if their data is transferred to a third party for processing — but, he added, the original data collector is still responsible for a third-party data breach.

Asked to give their top tips to marketers to prepare for C-27, Razdan said firms should try to better understand their customers’ views on privacy — how much personal data they want to keep, how much they are willing to share. Explaining why personal data is collected and how it will be used “will become the new norm,” he added.

Now is the time companies should review their privacy policies, and the website FAQs that explain them, Elder said. Firms should also think carefully about how their automated decision-making systems work.

Marketers in large firms should get to know the people who have to know the law — compliance and legal staff — said Maltby. Small and medium-sized organizations need to better understand the flow of personal data in their companies and what consents are attached to that data. “What is the current conversation you’re having with your customers about using their personal information?” she asked. “If you’re not having one … you really should.”

The post Proposed privacy law ‘pretty well balanced,’ Canadian marketers told first appeared on IT World Canada.

Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times.

Featured Tech Jobs


Related articles

Google Play introduces new biometric verification with a user warning

Google has recently announced updates to the biometric verification process for Google Play purchases, aiming to bolster security...

Cyber Security Today, Week in Review for week ending Friday April 19, 2024

On this episode Jen Ellis, co-chair of the Ransomware Task Force, talks about ways of fighting one of the biggest cyber threats to IT d

Cyber Security Today, April 19, 2024 – Police bust phishing rental platform, a nine-year old virus found on Ukrainian computers, and more

This episode reports on a threat actor targeting governments in the Middle East with a novel way of hiding malware is going international

Controversial expansion of US surveillance powers nears Senate vote

The US Senate is poised to vote on a significant expansion of Section 702 of the Foreign Intelligence...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways