On April 30, 2021, the Government of Ontario introduced Building a Digital Ontario, the province's new digital and data strategy, which lays the foundation for Ontario to become "the world's leading digital jurisdiction." Pursuant to the strategy, the Government of Ontario intends to create a new provincial data authority in consultation that will be responsible for "building modern data infrastructure to support economic and social growth at scale, while ensuring that data is private, secure, anonymous and cannot identify people individually."
The Government of Ontario also intends to create an artificial intelligence (AI) framework to "guide the responsible and equitable use of AI, with "beta" guidelines and principles to be released in spring 2021." This framework will focus on addressing new and emerging risks including "discrimination, surveillance, and threats to personal privacy." The strategy also contemplates digital advancements in citizen-centred services that "are available whenever and wherever you need them", such as an optional government-issued digital ID, digital reminders, and alerts for government renewals and services. Additionally, the strategy outlines a framework for the protection of privacy, particularly in the context of online commerce.
The creation of a provincial data authority by the Ontario Government is aligned with the proposed efforts at the federal level. In particular, the Government of Canada recently proposed the allocation of resources in the 2021 Federal Budget to establishing a new Data Commissioner for Canada. Based on the mandates described to date, it appears that the proposed Ontario provincial data authority and the federal Data Commissioner may have analogous and complementary roles and responsibilities. Our preliminary analysis of the proposal to create a Data Commissioner in the 2021 Federal Budget can be found in New Data Commissioner Proposed in the 2021 Federal Budget.
Ontario would be the first province in Canada to create a provincial data authority with a focus beyond privacy and data protection. The creation of this authority raises many key questions, including the scope of the authority's responsibilities and powers, and how it will interact and work with the existing Information and Privacy Commission of Ontario. There are also questions surrounding how the proposed reforms of Canada's federal privacy laws may impact this Ontario initiative. In November 2020, the federal government tabled Bill C-11, which proposes to enact the Consumer Privacy Protection Act (CPPA) in replacement of the existing federal privacy regime under Personal Information Protection and Electronic Documents Act. Our preliminary discussion on the CPPA can be found in Understanding the Draft Consumer Privacy Protection Act: A Summary of the Key Changes Proposed.
Whether other provinces will follow suit in creating their own provincial data authority remains to be seen. Certain provinces, like Alberta and British Columbia, currently have private sector privacy legislation that applies instead of PIPEDA because of their "substantially similar" status for the collection, use, and disclosure of personal information occurring within that respective province. That said, as CPPA is proposing significant changes to the federal privacy regime, it is unclear as to whether existing provincial legislation will retain the status of being substantially similar. Based on the proposed reforms to Canada's privacy regime, there is a real possibility that other provinces will begin taking similar initiatives, leading to significant changes surrounding privacy compliance at both the federal and provincial levels. All of this change is against a backdrop of significant movement in U.S. State and Federal governments in the data protection and data mobility and use realms, and amidst ongoing review by the E.U. of whether and how cross-border, inter-jurisdictional data flows can be made compliant with GDPR and if the various regulatory regimes are substantially equivalent.
The Government of Ontario has indicated that it will hold public consultations in Summer 2021 in connection with the creation of a new data authority. The consultations are intended to "focus on helping the government develop new data stewardship models, governance, and standards—and identify early use cases to become digital “shovels in the ground” projects."
The Privacy & Data Protection team at Bennett Jones will continue to monitor updates on the consultation process, and is available to help interested organizations prepare for and participate in the consultation.