Tuesday, June 30, 2015
PIPEDA Amendments Finally Enacted
If technology is the hare, legislation is the tortoise when it comes to privacy protection and Canada is the slowest turtle in the pack. As we await the finalization of the EU's General Data Protection Regulation, first proposed in January 2012, and modernization of the Electronic Communications Privacy Act, first introduced into Congress in 2011, the Canadian Parliament has finally enacted some modest amendments to the Personal Information Protection and Electronic Documents Act, some nine years after the initiation of a legally mandated review in 2006. Bill S-4, the Digital Privacy Act, received royal assent on June 18, with some amendments to PIPEDA coming into effect immediately, including clarifications of consent and regulatory compliance agreements, an exemption for business contact information and the waiving of consent requirements in typical employment-related contexts. The most important amendment, establishing a national data breach notification regime with significant deadlines and fines, will come into force only after public consultation has been held and implementing regulations have been developed and issued.