Alberta’s legislation on privacy and protection of personal information needs review: commissioner

Law360 Canada (January 4, 2021, 8:36 AM EST) -- Alberta’s information and privacy commissioner is calling on the provincial government to look at updating its legislation on the protection of privacy and personal information in light of the sweeping technological change brought about by the COVID-19 pandemic and a movement to change similar legislation in other jurisdictions.

In a letter to Service Alberta Minister Nate Glubish, Jill Clayton said the Freedom of Information and Protection of Privacy (FOIP) Act and the Personal Information Protection Act (PIPA) should be reviewed and updated by provincial legislators to reflect the growing digital economy and enhanced expectations in society on access to information and privacy rights.

“Over the past several years, public scrutiny of access and privacy laws has increased, and the COVID-19 pandemic has intensified the spotlight on access and privacy rights. These realities reinforce the need for a guided public consultation on how to improve the FOIP Act and PIPA,” she wrote. “Public reviews by a special committee of the legislative assembly would allow my office and all stakeholders to engage in meaningful and helpful discussions on improving the laws.”

Clayton is recommending the FOIP Act be updated to require mandatory notifications of a privacy breach, and PIPA be amended to make it apply fully to all non-profit organizations and political parties, give individuals the right to extract all their data from an organization and transfer it to a different platform, further consultations on a right to erasure (also known as a “right to be forgotten,” where private information about a person is removed from Internet searches), and perhaps most consequently, grant the commissioner power to administer monetary penalties for privacy violations.

Marc Yu of Field Law said Clayton’s suggested changes “probably won’t come as a surprise to the privacy geeks of the world.”

“It has been a busy year for privacy, not just in the sense we have all been working from home and we have all had to embrace technology on a more frequent basis than before,” he said. “These Acts are inherently complex, and the changes in the public’s general awareness of privacy and what that means over the last decade is going to place some urgency on some of these proposed recommendations, but we have to wait and see what the government response might be.”

Yu noted many commentators have raised concerns that Alberta’s privacy legislation lacks teeth in terms of enforcement.

“There are tools that the commissioner has to enforce compliance, such as the ability to take steps to prosecute individuals and organizations for non-compliance, but these processes are often complex and expensive and exercised on a very infrequent basis,” he said. “Administrative monetary penalties would allow the commissioner another tool for compliance and we have seen that tool used in other areas, such as Canada’s anti-spam legislation, which can have a significant impact on organizations in terms of the amount of fines which are issued.”

James Swanson of Calgary’s Swanson Law said the recommendations are being made in the context of a “much larger, bigger picture situation,” namely the federal government’s decision to overhaul its own Personal Information Protection and Electronic Documents Act (PIPEDA). Under federal law, PIPEDA applies to every province unless that province has “substantially similar” legislation, which Alberta has.

“It makes sense that Alberta would try to keep up — having two statutes doesn’t make much sense,” he said. “Data doesn’t pay much attention to national borders and there is a move afoot across Canada to pay more attention to privacy, while still trying to respect the needs of business.”

But Swanson said one thing which raised red flags for him was the commissioner’s suggestion to strengthen oversight of solicitor-client privileged material by requiring public bodies to produce records over which privilege is being claimed.

“Currently that goes to the courts, and it is essentially proposed that the commissioner would be able to see the material but there would be no waiver of solicitor-client privilege,” he said. “But that privilege is owned by the client so the solicitor doesn’t have the right to talk without a client’s information and only the client can actually waive that. My concern is you would be risking a breach of solicitor-client privilege, which is one of the absolute confidences we have.”

Glubish’s press secretary Tricia Velthuizen said the minister has had several conversations with Clayton about Alberta’s privacy legislastion and “he continues to have those conversations.”

“With a growing digital economy, made all the more important due to the current pandemic, it’s important to have conversations about how privacy laws, technology and digitization intersect and what changes may need to be made to provide a framework for both the present and future,” said Velthuizen.

In addition to the federal overhaul of PIPEDA, Ontario launched a public consultation in August 2020 to look at introducing its own private sector privacy law, and British Columbia’s legislation on protection of personal information was under review by a special parliamentary committee before the last provincial election was called. Many of the proposed changes reflect the principles outlined in the European Union’s general data protection regulation, which came into force in 2018.

Swanson said companies “usually just comply with the highest bar” when it comes to privacy legislation but certainty in the rules is important for business.

“When you get into patchworks where Alberta has different rules from the federal government or Ontario, it makes it harder for business,” he said. “If they are more generally the same it just makes it easier to deal with it.”

If you have any information, story ideas or news tips for The Lawyer’s Daily please contact Ian Burns at Ian.Burns@lexisnexis.ca or call 905-415-5906.