The Potential Impact of Bill C-27 on School Boards

  • 10 mai 2023
  • Nadya Tymochenko and Kayla Cockburn

In June 2022, the Minister of Innovation, Science and Industry introduced in the House of Commons Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts.

Bill C-27, which completed Second Reading on April 24, 2023, represents the Canadian government’s second attempt to reform federal privacy laws applicable to commercial activities. If passed, it will create three new pieces of federal legislation: the Consumer Privacy Protection Act (CPPA), the Personal Information Protection Tribunal Act (Tribunal Act) and the Artificial Intelligence and Data Act (AI Act). It will also repeal Part 1 of the Personal Information Protection and Electronic Documents Act to remove its privacy protection authority, and change the short title to Electronic Documents Act.

At a recent symposium, Philippe Dufresne, the Privacy Commissioner of Canada, spoke about how Bill C-27 is an important step forward to modernizing Canadian privacy law.[1] He emphasized the fundamental and quasi-constitutional nature of privacy, and reminded his audience that this means we should treat the right to privacy as a priority, as we do other human rights.

The Tribunal Act will establish a Tribunal to hear matters subject to the authority of the CPPA, and the AI Act will regulate international and interprovincial trade and commerce in artificial intelligence systems.

Among its provisions, the CPPA maintains informed consent as the primary authority for organizations to collect personal information.[2] It includes the right to request disposal at an individual’s request,[3] and also specifies “exceptions to consent” for the collection, use, or disclosure of personal information for certain business activities and for socially beneficial purposes.[4] The CPPA imposes administrative monetary penalties if an organization is found to have violated provisions under the Act.[5]