Heightened Privacy Obligations for Organizations in Alberta: Changes May Be on the Horizon

Written By Stephen Burns, Sebastien Gittens and David Wainer

The review of Alberta's Personal Information Protection Act (PIPA) currently underway by the Alberta Standing Committee on Resource Stewardship (the Committee) continues, with the Privacy Commissioner of Canada recently appearing before the Committee. In light of this review, changes may be coming to private-sector personal information laws in Alberta.

Alberta Information and Privacy Commissioner's Recommendations to the Committee to Date

In light of the Committee's ongoing review of PIPA, the Alberta Information and Privacy Commissioner Diane McLeod made recommendations in June 2024 to update PIPA to reflect the modern state of technology and how personal information is often shared by individuals with organizations. Amongst a variety of recommendations, Commissioner McLeod broadly stated that PIPA should be amended to include:

1. recognition that the protection of personal information is a human right;
2. the express right for Albertans to access their own personal information that is in the custody or control of an organization;
3. the "right to be forgotten";
4. heightened protection for personal information that relates to children;
5. various requirements around compliance, notification, and communicating in plain language; and
6. circumstances wherein personal information must be de-identified or anonymized. The stated goal of these recommendations is to "…achieve a proper balance between protecting privacy and enabling the use of technology by business in order to prosper."

Privacy Commissioner of Canada's Appearance Before the Committee

Adding to the momentum that changes may be coming to PIPA, the Privacy Commissioner of Canada, Philippe Dufresne, appeared before the Committee on September 24, 2024.

In his remarks, Commissioner Dufresne detailed the importance of the interoperability of privacy laws. Put simply, Commissioner Dufresne reiterated that Canadians should trust that their personal information held by organizations should be kept safe and protected, regardless of where it resides or is transferred. Of note is that a high degree of interoperability would in fact benefit organizations, as compliance costs would be reduced.

Commissioner Dufresne also spoke on the impacts of Bill C-27, the Digital Charter Implementation Act. Currently in consideration by the House of Commons' Standing Committee on Industry and Technology, Bill C-27 would, among other things, repeal the Personal Information Protection and Electronic Documents Act and enact the Consumer Privacy Protection Act (the CPPA).

Many of the goals of the CPPA are similar in nature to those of Commissioner McLeod's. That is, Commissioner Dufresne recognized certain fundamental privacy rights in his remarks on September 24, 2024, that echo Commissioner McLeod's earlier recommendations. 

We anticipate that the CPPA will have a substantial impact on organizations on the extent of regulatory scrutiny of organizations with respect to their privacy practices. For further analysis of the CPPA, as well as other impacts of Bill C-27, please see our previous blog, Minister of Innovation, Science and Industry of Canada Releases Proposed Amendments to the Digital Charter Implementation Act. 

Conclusion

It appears that both the Alberta Information and Privacy Commissioner, as well as the Privacy Commissioner of Canada, share common principles with respect to privacy rights in the 21^st century. Given that the CPPA endeavours to establish stronger privacy protections for individuals, Alberta's PIPA may be revised to strengthen its own protections. Accordingly, organizations are encouraged to continue to monitor any developments arising from the Committee's ongoing review of PIPA. If you would like to know more about this subject, we invite you to contact the members of the Bennett Jones Privacy & Data Protection group.

Download PDF