CPPA Archives

Canada Right to Be Forgotten and Search Engines

Late last month, the Privacy Commissioner of Canada (“OPC” or “Commissioner”) released a report of its findings holding that search engines like Google can be required to de-list personal information about an individual. While the decision generally aligns Canada’s federal privacy law PIPEDA with the right of erasure or “right to be forgotten” under the GPDP, the UK GPDR, and Quebec’s updated privacy law, the decision illustrates some problematic aspects of PIPEDA and the Commissioner’s interpretation of this important privacy law.…

View Post

View Post

CPPA
Privacy

Privacy of IP Addresses: Understanding the Supreme Court Ruling in R. v. Bykovets

In R. v. Bykovets, 2024 SCC 6, the Supreme Court of Canada ruled that for Charter of Rights purposes, a person being investigated by the police has a reasonable expectation of privacy in an IP address in the possession of a third person, in this case a payment processor, even when not linked to any personally identifying information. The decision and its importance is explained in a blog post written by my colleagues Dan Glover, Andrew Matheson, Connor Bildwell, Greer Hope and I on the McCarthy Tetrault TechLex blog.…

View Post

View Post

Government proposals to amend CPPA and AIDA: the good, the bad, and the challenges ahead Part 1

In response to criticisms about Bill C-27, the Digital Charter Implementation Act, 2022, and especially criticisms related to AIDA, the Government disclosed amendments it proposes to make while the Bill is before the INDU Committee. This blog focuses on the proposed amendments and, in particular, the areas where the Minister’s proposed amendments have helped to move the Bill in the right direction or have failed to address or failed adequately to address criticisms of the Bill.

I first provide some background explaining the genesis of the amendments and then provide an analysis of the amendments.…

View Post

View Post

Legality of search engines and AI systems under PIPEDA and CPPA: Google v Privacy Commissioner

The Federal Court of Appeal just released an important opinion in Google LLC v. Canada (Privacy Commissioner) 2023 FCA 200, holding that Google cannot rely on the journalistic exception in PIPEDA to operate legally in Canada. The decision is a frustrating one because it fails to resolve whether PIPEDA’s restrictions on Google and other search engines are consistent with the Charter and if not, how search engines and artificial intelligence systems can operate legally in Canada. These important questions are unlikely to be resolved soon under the OPC’s ill conceived reference process.…

View Post

Digital Charter Implementation Act and CPPA

View Post

CPPA
Privacy

CPPA: problems and criticisms – automated decision making

Canada is planning to revamp its comprehensive privacy law by repealing the existing comprehensive privacy law, PIPEDA, and by enacting Bill C-27, the Digital Charter Implementation Act (“DCIA”) to enact the Consumer Privacy Protection Act (CPPA), Personal Information and Data Protection Tribunal Act (PIDTA), and Artificial Intelligence and Data Act (AIDA). Bill C-27 replaced Bill C-11 (the former drafts of the CPPA and PIDTA). While the DCIA attempts to rectify some of the criticisms with Bill C-11, many of the problems remain and problems have emerged in the new Bill.…

View Post

CPPA: problems and criticisms – anonymization and pseudonymization of personal information

View Post

CPPA: problems and criticisms – service provider obligations

View Post

CPPA
Privacy

CPPA: problems and criticisms – appropriate purposes

View Post

CPPA
Privacy

The Digital Charter Implementation Act: problems and criticisms – the preamble

Canada is planning to revamp its comprehensive privacy law by repealing the existing privacy law, PIPEDA, and by enacting Bill C-27, the Digital Charter Implementation Act (“DCIA”). This law would enact three separate but interrelated laws, the Consumer Privacy Protection Act (CPPA), Personal Information and Data Protection Tribunal Act (PIDTA), and Artificial Intelligence and Data Act (AIDA). Bill C-27 replaced Bill C-11 (the former drafts of the CPPA and PIDTA). While the DCIA attempts to rectify some of the criticisms with Bill C-11, many of the problems remain and problems have emerged in the new Bill.…

View Post

Using privacy laws to regulate automated decision making

Making decisions about individuals using computers and computer algorithms is now commonplace. There are now also increasing proposals to use privacy laws to regulate automated decision making. One of the first explicit attempts to regulate automated decision-making using privacy laws is the European Union General Data Protection Regulation (GDPR). More recently (and locally), both the Consumer Privacy Protection Act (CPPA), Canada’s proposed controversial new privacy law, and Bill 64, Quebec’s proposed privacy amendments, would enact new transparency and explainability obligations for automated decision making.…

View Post

Subscribe