Larger fines needed to deter privacy breaches: B.C. privacy commish

OTTAWA — Fines levied against companies who breach privacy rules in Canada need to be increased to help prevent breaches in the future and to come in line with European Union data protection rules, British Columbia’s privacy commissioner told a Parliamentary committee Tuesday. Drew McArthur, B.C.’s acting privacy commissioner, told the House standing committee on access to information, privacy and ethics, which is reviewing the Personal Information Protection and Electronic Documents Act (PIPEDA), that “we believe that we need greater deterrents in the form of larger fines.” McArthur said fines of up to 10 million euros can be levied against companies in Europe who fail to notify affected individuals when breaches are committed. In other areas, fines can reach up to 20 million euros, he said. “In B.C. and Canada, our fines do not keep up with these standards,” he said. In comparison, Canada’s Digital Privacy Act stipulates that companies that do not inform customers about personal data breaches, “or knowingly fail to maintain a record of all breaches,” face fines of up to $100,000, according to the privacy commissioner's website. McArthur said that both Canada and the provinces “have to examine the amount of their fines and bring them more into line” with European Union data protection regulations, coming into effect in 2018, to maintain Canada's adequacy status. The committee was previously told that Canada needs to change its rules, including around a right to be forgotten, to keep pace with the EU and not risk losing that status, which allows Canada to receive European data without additional authorization. The committee has also heard arguments that the federal privacy commissioner’s powers should be expanded to include fining and order-making powers, including from federal commissioner Daniel Therrien himself. The question came up again on Tuesday, when committee vice-chair Nathaniel Erskine-Smith asked whether the federal privacy commissioner should be vested with the power to levy administrative monetary penalties. Alberta’s privacy commissioner Jill Clayton said Tuesday that the privacy commissioner must “absolutely” have enforcement powers. She also said there has a been an “uptick” in the number of cases dealing with the right to be forgotten, and noted there is currently such a case in front of the Supreme Court and federal court recently ruled on a similar case that involved worldwide erasure of personal information. “We have half a dozen in the office right now,” Clayton said. The committee also heard arguments about what should be done about mandatory breach notification policies, with B.C. deputy commissioner Michael McEvoy saying breach notifications should be a standard in the country. “I think everybody is going to have to come up to those standards,” he said. Currently, only some provinces mandate breach notification, while PIPEDA was amended to include notification requirements in 2015. In 2010, Clayton said Alberta became the first jurisdiction in the country to place such requirements on the private sector. Since that year, she said the province received close to 750 breach reports under its privacy act and made 600 decisions. About 56 per cent of those cases would have caused “significant harm,” she added. — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

Larger fines needed to deter privacy breaches: B.C. privacy commish

Broadcast | February 22, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Larger fines needed to deter privacy breaches: B.C. privacy commish

Broadcast | February 22, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

CRTC announces changes to Broadband Fund

CRTC launches consult on providing more info to consumers shopping for internet services

Champagne announces launch of Canadian AI Safety Institute

Satellite is ‘here to stay’ as connectivity solution, industry players say

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us