Hot Button Enforcement Issues In the New Canadian Consumer Privacy Protection Act

Part One of this series discussed the history of Canada's recently introduced Consumer Privacy Protection Act and reviewed the similarities with GDPR, such as data portability, the right not be forgotten, codes of practice, and a safe harbor provision. Part Two of this analyzed the new compliance requirement of valid consent. Part Three continued the analysis of new compliance requirements, including the content of organizational privacy policies and anonymization of personal information policies, and business transaction policies contained in the Act. Part Four concludes the series with a look at hot button enforcement issues in the Act.

Hot Button Issues for Enforcement

As previously noted, one of the most significant aspects of the Act is the significant range of enforcement remedies. Given that the emphasis in this article is on compliance for privacy officers, those have not been reviewed in detail. However: a) the penalties that can be imposed by the Data Tribunal; and b) the slightly extended list of offences for which fines may be applied, helpfully set out a guide as to which features of an organization's privacy compliance program will likely be the focus of enforcement, and should therefore be revisited by privacy officers with a view to strengthening those aspects of their privacy programs.

Hot Button Issues #1: As Indicated by Tribunal Penalties

Maximum Fines