{"id":37050,"date":"2023-08-28T14:30:01","date_gmt":"2023-08-28T18:30:01","guid":{"rendered":"https:\/\/www.cccc.org\/news_blogs\/?p=37050"},"modified":"2023-08-28T14:30:04","modified_gmt":"2023-08-28T18:30:04","slug":"playing-privacy-catch-up","status":"publish","type":"post","link":"https:\/\/cccc.org\/news_blogs\/cccc\/2023\/08\/28\/playing-privacy-catch-up\/","title":{"rendered":"Playing (Privacy) Catch-Up"},"content":{"rendered":"\n

New legislation is regularly introduced to respond to emerging technology and resulting gaps in existing laws. One example of this is the government’s desire to better regulate how organizations handle privacy and consumers\u2019 personal information. And, while the emphasis is typically on for-profit corporations, charitable organizations should also be mindful.<\/p>\n\n\n\n

In this blog, I\u2019ll examine the current privacy framework, a recent attempt to address some legislative deficiencies, and what\u2019s on the horizon.<\/p>\n\n\n\n

The Current Framework<\/h2>\n\n\n\n

The existing federal privacy legislation, Personal Information Protection and Electronic Documents Act<\/em> (\u201cPIPEDA<\/a>\u201d), applies to all organizations engaging in ‘commercial activities’. This may leave charities with the impression that it does not apply to them at all, but that\u2019s not necessarily the case. Instead of taking a broad look at the nature of an organization \u2013 a for-profit business and commercial activities go hand-in-hand, but the same ought not be said for charitable organizations \u2013 PIPEDA considers a particular activity’s nature.<\/p>\n\n\n\n

This means that PIPEDA\u2019s standards and regulations do apply charitable organizations if they engage in commercial activities. So, what exactly are commercial activities?<\/p>\n\n\n\n

PIPEDA and the Office of the Privacy Commissioner of Canada<\/a> define commercial activities as \u201c\u2026any particular transaction, act or conduct or any regular course of conduct that is of a commercial character\u2026”. This\u00a0government resource<\/a>\u00a0makes it clear that determining ‘commercial activity’ is the most important consideration for determining if PIPEDA applies. When discussing non-profits, it specifically includes “the selling, bartering or leasing of donor, membership or other fundraising lists”.<\/p>\n\n\n\n

Charities will want to ask themselves if how they use or share these lists could constitute a \u2018commercial activity\u2019 under PIPEDA.<\/p>\n\n\n\n

The Well-Intentioned, Never-Finished Update to PIPEDA<\/h2>\n\n\n\n

Bill C-11<\/a> was first introduced in November 2020. It was the government\u2019s initial attempt to update PIPEDA and other data privacy legislation for consumers. Partly due to the federal election in 2021, the Bill was abandoned and did not get through second reading (learn more about how a bill becomes a law here<\/a>).<\/p>\n\n\n\n

However, the basic framework in C-11 was re-introduced in June of 2022 as Bill C-27<\/a>. It is currently under consideration in committee in the House of Commons, having made it through second reading on April 24, 2023. This Bill includes a number of privacy considerations all organizations will need to be aware of, even if some of those considerations don\u2019t apply to them.<\/p>\n\n\n\n

New Legislation Incoming<\/h2>\n\n\n\n

While not identical, Bill C-27 bears a strong resemblance to its predecessor. Its short title, the Digital Charter Implementation Act, 2022<\/em> (\u201cDigital Charter\u201d) means its subject matter is broader than privacy considerations under PIPEDA, and we will continue to monitor its other implications as they relate to charities. For our purposes, it\u2019s important to note that Part 1 of the Digital Charter enacts the Consumer Privacy Protection Act<\/em> (\u201cCPPA\u201d, or the \u201cAct\u201d), which will replace Part 1 of PIPEDA and introduce additional privacy considerations.<\/p>\n\n\n\n

Until it’s enacted and a judge interprets the new Act, we won\u2019t know if there are more or markedly different privacy considerations than those currently under PIPEDA. However, whether or not an organization is engaged in commercial activities will continue to be a central consideration under the CPPA privacy regime. We know this because section 6(1) of CPPA states that the Act applies to every organization in respect of personal information that the organization “collects, uses or discloses in the course of\u00a0commercial activities\u201d, including charitable organizations.<\/p>\n\n\n\n

In trying to explain section 6(1), section 6(2)(a) states that “for greater certainty,” the
Act will apply to personal information that an organization “collects, uses or discloses interprovincially or internationally”. This will likely mean that if a charity possesses personal information that it then shares with organizations – even affiliated ones, like two offices of the same denomination – outside of the province where the information is collected, used, or disclosed for a “commercial activity” purpose, that charity will have to follow the CPPA\u2019s privacy requirements.<\/p>\n\n\n\n

Some of these privacy requirements include:<\/p>\n\n\n\n