Violations of privacy–already regulated by the Office of the Privacy Commissioner of Canada (as well as provincial privacy regulators)–may also soon be regulated by Canada’s Competition Bureau. In a statement yesterday at the Data Forum in Ottawa, Canada’s newly appointed Competition Commissioner, Matthew Boswell, has suggested that the $10-million cap on fines for deceptive practices may not be appropriate for violations of privacy by app makers. The Competition Commissioner has previously stated that his agency is considering pursuing app makers who use personal data without clear consent. The bureau has not yet asserted its authority to regulate these violations of privacy, but these statements suggest that Canada may not be far off from this additional regulation of privacy matters.
As Bennett Jones reported years ago, the intense focus by the United States Federal Trade Commission (FTC) on privacy violations likely foreshadows things to come in Canada. The FTC has prosecuted several companies under its authority to regulate deceptive practices and its jurisdiction to do so has been upheld by the Third Circuit Court of Appeals. The Competition Bureau likewise oversees complaints of deceptive marketing practices and so it is not surprising to see some movement toward regulation of privacy violations based on this legislative authority, particularly given the absence of any fines in Personal Information Protection and Electronic Documents Act privacy violations.
The statements by the Competition Commissioner highlight an increasingly intense focus in Canada on obtaining valid and meaningful consent for the use of personal information. Organizations can expect to come under increased scrutiny for privacy matters. While Canada’s regulation of privacy has historically been seen to be lacking in “teeth”, significant change appears to be on the horizon.