CAFII held a webinar on privacy issues and trends in insurance on 26 January, 2023 with Dallas Ewen, Canada Life, and David Elder, Stikeman Elliott.
David Elder said that from a business perspective, privacy laws to date in Canada have been quite effective. In the common-law provinces, those laws are largely principles-based, and Privacy Commissioners have been able to deal with a wide variety of issues. There are significant non-monetary penalty reasons why companies want to comply with privacy requirements. One problem, however, is that there is no real way to appeal a ruling made by a Commissioner. Dallas Ewen agreed that the privacy regime is largely effective in Canada. He also agreed that there is difficulty challenging privacy rulings, but the new federal Bill C-27 does provide for a tribunal that, to an extent, addresses this shortcoming.
Dallas Ewen noted that there is a lack of privacy laws harmonization in Canada from jurisdiction to jurisdiction. There is the federal Personal Information Protection and Electronic Documents Act (PIPEDA) which applies everywhere in Canada except where there are provincial regimes that have been deemed to be substantially similar to PIPEDA — which is the case for British Columbia, Alberta, and Quebec (Personal Information Protection Acts (PIPA) in BC and Alberta, and a different name in Quebec). But there are some small differences between the different regimes. The most significant difference between the regimes is around the obligation to report breaches. David Elder echoed Mr. Ewen’s sentiments, but noted that those challenges are not that different from other jurisdictional issues that exist in Canada in other sectors. There is also broad co-operation and co-ordination between regulators, which is helpful. However, new challenges may come about with Quebec’s recently modernized privacy legislation, which will make it a bit of an outlier.
David Elder built on those comments by noting that Quebec has recently taken a very different approach and is making major amendments to its privacy regime. Quebec’s amendments are taking place over several years and reflect a new direction, which is more similar to the approach taken in Europe (the European Union’s General Data Protection Regulation or GDPR). In general, there are higher standards and expectations now in the Quebec requirements as well as new, additional requirements. Quebec’s new law is also imposing requirements not just for activity outside of the country, but outside of Quebec. There are also now significant new monetary penalties in the Quebec legislation, and a right of private litigation. Dallas Ewen agreed that the new rules are different from elsewhere in Canada and quite intense. There is more of a philosophy in this new regime around viewing privacy as a human right.
Notwithstanding Quebec developments, most other jurisdictions in Canada are also looking mainly at international developments, including in California and the European Union’s GDPR. The federal privacy rules that are being modernized in Bill C-27, if passed, will replicate many of the features of the Quebec rules. Canadian privacy laws will likely have to be reformed in order to align more closely the GDPR and with international developments generally, especially in terms of enforcement and having significant monetary penalties for non-conforming businesses.
Any business that is data-dependent will have to deal with the issues around the use of personal information. If data was once personal information and in aggregated form could be tied back to an individual, such data could now be captured by the more stringent rules in Europe and elsewhere.
There were attendees at the webinar from allied industry associations CLHIA, THIA, and the Canadian Bankers Association (CBA), and from regulatory and policy-maker organizations including:
- the Canadian Insurance Services Regulatory Organizations, or CISRO;
- the Insurance Councils of Saskatchewan, or ICS;
- the Alberta Insurance Council, or AIC;
- the Government of Alberta;
- the British Columbia Ministry of Finance; and
- the British Columbia Financial Services Authority, or BCFSA.