A Compliance Briefing for Privacy Officers on the New Canadian Consumer Privacy Protection Act

Part One of this series discussed the history of Canada's recently introduced Consumer Privacy Protection Act and reviewed the similarities with GDPR, such as data portability, the right to be forgotten, codes of practice, and a safe harbor provision. Part Two analyzes the new compliance requirement of valid consent.

Other New Compliance Requirements

While necessarily not exhaustive, we have highlighted below some of the other new compliance requirements which should be of most interest to privacy officers.

Valid Consent

PIPEDA already imposes a reasonably robust set of requirements on organizations in order to ensure that the consents that they obtain from data subjects are clear and informed:

1. Organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used.
2. To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.
3. The consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization's activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting.

The Act, however, takes a complete recut of the language outlining the preconditions which are required to be met in order for a consent to be valid:

1. at or before the time that the organization seeks the individual's consent, it must provide the individual with the following information:
   1. the purposes for the collection, use or disclosure of the personal information
   2. the manner in which the personal information is to be collected, used or disclosed;
   3. any reasonably foreseeable consequences of the collection, use or disclosure of the personal information;
   4. the specific type of personal information that is to be collected, used or disclosed; and
   5. the names of any third parties or types of third parties to which the organization may disclose the personal information (Section 15(3)); and
2. the information in the consent must be provided in "plain language that an individual to whom the organization's activities are directed would reasonably be expected to understand" (Section 15(4)).

By requiring that the information in the consent has to be provided in "plain language that an individual to whom the organization's activities are directed would reasonably be expected to understand," the Act introduces a somewhat subjective standard. It is not fully subjective: that would require that the actual recipient would reasonably understand. Rather, this is directed at the 'target' recipient of the organization. That being said, apart from consents addressed at children or individuals with limited capacity, it is difficult to see how the vast range of individuals to whom an organization's activities are directed would be affected by this requirement.