Bill C-11 and startups: the good, the bad, and the ugly

The good

CPPA provision

Summary of the proposed rule change

Implications for startups

Service provider exemption

This exemption now allows accountable organizations to transfer personal information to a service provider (now a defined term²) without individual knowledge or consent. However, as the accountable party³ the organization is required to impose controls (contractual or otherwise) on service providers to ensure equivalent protections⁴.

This new exemption recognizes that as businesses go digital, they need to be able to seamlessly outsource functions to service providers and share data across borders.

It is good news for startups that are service providers since it adds clarity to a previous area of regulatory uncertainty and will permit accountable organizations to share personal information with its vendors and affiliated business more efficiently.

Business operations exemption

This new consent exemption permits companies to collect and use personal information if it is:

• within the reasonable expectation of the individual;
• not for the purposes of influencing the individual’s behavior or decisions (i.e., not for marketing or profiling); and
• for limited, prescribed activities such as service delivery, safety, risk mitigation or cybersecurity.

If your startup is already established and compliant with PIPEDA, in practice it is unlikely that your business will see an expanded ability to process personal information without consent given that many of these activities are already permissible as a condition of service or with implied consent under PIPEDA.

Data portability

Individuals will have a new right to request that an organization transfer the personal information it has collected from them to another organization. However, the details and scope of application will be set out in a data portability framework regulation.

Data mobility will be a boon to startups. In addition to creating a more level-playing field, innovative startups will benefit from access to data in greater volumes. At the same time, startups will need to develop processes and implement data hygiene best practices to ensure they are efficiently able to de-lineate between the information they directly collected from the individual versus data (and IP) the organization created.

CPPA’s reference to the creation of a data portability framework combined with the technical and data security issues that need to be addressed in regulations indicates that the right will be implemented sectorally. Given the federal government’s ongoing open-banking discussions, we anticipate that the right to data portability will be first rolled out in financial sector, making fintechs the first beneficiaries.

The bad

CPPA provision

Summary of the proposed rule change

Implications for startups

De-identification

CPPA introduces a few de-identification related provisions:

• concept of ‘de-identified information’: CPPA’s definition of “de-identification” is broad enough to cover a spectrum of de-identified information, from the rigorous concept of anonymized information to the less onerous concept of pseudonymized information;
• de-identification exemption: this allows organization to convert an individual’s personal information into “de-identified information” without their knowledge or consent;
• limited use of de-identified information: under CPPA, de-identified information can only be used without consent for the following purposes: i) internal research and development; and ii) socially beneficial purposes. Additionally, organizations must not use de-identified information to identify an individual, except in order to test the effectiveness of security safeguards used to protect the information; and
• technical and administrative requirements: organizations will be required to ensure that any technical and administrative measures applied to “de-identified information” are proportionate to the purpose for which the information is de-identified and the sensitivity of the personal information.

Even though the CPPA settles a long-standing ambiguity by allowing organizations to de-identify information without consent, it limits the use of de-identified information to a few purposes (internal R&D and socially beneficial purposes). Such an approach to “de-identification” has the effect of expanding the law’s jurisdiction beyond personal information.

This could impact B2B AI and data analytics-based organizations’ ability to use their customer’s end-user “de-identified information” for their own purposes, for example, to develop or improve their AI or analytics product or service.

Right to disposal⁵

Individuals can request that an organization delete their personal information, subject to legal retention obligations or where it can’t be severed from others’ personal information. This right is limited to information collected from the individual (i.e., not information created by the organization, such as inferential data, or obtained from third parties).

CPPA also imposes an obligation on the accountable organization to ensure that service providers have deleted the information as well.

Given the requirement to ensure that service providers permanently delete personal information, this requirement will not only impact organizations that directly collect information from individuals for their own purposes but also startups that work along the data processing and management supply chain. In addition to implementing processes to ensure they can give effect to such requests, organizations will need to keep up-to-date data inventories to make sure they are able to delete all of the personal information in their possession or under their control.

It is currently unclear whether the ‘permanent deletion’ requirement would: extend to some or all forms of de-identified information (e.g., pseudonymized versus anonymized information).

Algorithmic transparency

CPPA’s new algorithmic transparency requirement has two components:

• disclosure: explain in plain language if the organization uses any automated systems that make predictions, recommendations or decisions about individuals that could have significant impacts on them; and
• broad right to explanation: in conjunction with individual’s right to access and amend personal information, the CPPA also provides a right to an explanation of a “prediction, recommendation or decision” made using an automated decision system, and how their information was used to make such a determination.

CPPA does not include a right to object to or opt out of the use of such automated tools.

It is important to note that the right to an explanation does not contain the “significant impact” qualifier included in the disclosure requirement. This means, organizations will need to be able identify, track and document all automated systems that use an individual’s personal information to make determinations and to be able explain in plain language how their information was used to make a “prediction, recommendation or decision”.

The requirements are general enough that we don’t anticipate companies being compelled to disclose proprietary information about how their algorithms work or to explain the inexplainable (e.g., the “hidden layer” in an artificial neural network).

Business transaction exemption

PIPEDA permits organizations to share personal information without consent for due diligence purposes in a business transaction. CPPA proposes to add a new requirement that the seller de-identify personal information before sharing it with a potential buyer.

If passed in its current form, this would have significant impacts on investment diligence and deal process by adding time and expense for the startup to de-identify information critical to evaluating the transaction (e.g., information about key customers or (for limited federal entities) employees).

The ugly

CPPA provision

Summary of the proposed rule change

Implications for startups

Scalable privacy management program

Organizations must take into consideration the volume and sensitivity of personal information under their control when developing privacy management programs.

This requirement will significantly impact data-intensive startups. Any organization—irrespective of size or stage of development—that handles large volumes of personal information and/or processes sensitive information will be required to implement robust privacy practices. This means startups will need to allocate significant resources to privacy management from the get-go.

Penal regime and investigation powers

CPPA proposes to give the OPC the following supplemental powers:

• order making powers: authority to compel an organization to comply with the statute, cease or modify its practices and to publish those steps. Additionally, the OPC will have the power to make interim orders in the midst of an investigation or audit; and
• recommend penalties: authority to recommend⁶ that the Tribunal impose administrative monetary penalties of up to $10 million or 3% of an organization’s gross global annual revenue for contravention of processing provisions and certain security safeguard provisions⁷.

This will increase the burden of regulatory investigations on businesses, because their data processing activities may be interrupted even before the OPC has decided if the company is offside the new law. The ability to force an organization to change its business model and recommend a financial penalty will heighten the impact of a negative OPC finding beyond the current name and shame regime.

Fines

For more egregious contraventions⁸ of the CPPA an organization could face a criminal conviction and be fined up to 5% of annual global revenue or $25 million, whichever is greater. These offences would be prosecuted by the Attorney General of Canada.

Fines under the new regime will raise multiple related risks for companies, such as whether such costs can or will be insured or indemnified, the business and reputational impact of a criminal conviction as opposed to a regulatory finding, and shareholder or consumer litigation arising from findings of intentional misconduct.

Private right of action

CPPA introduces a private right of action in court following a finding of non-compliance by the OPC or the Tribunal. Unlike in some international regimes, CPPA does not propose statutory damages—rather claimants must prove loss or injury.

Businesses may see increased litigation activity in cases where the OPC has found they violated CPPA but the facts wouldn’t otherwise support a damages award under common law causes of action such as privacy torts, negligence or breach of contract. For example, it may be easier in a data breach case for consumers to prove breach of the statutory requirement to implement appropriate safeguards than that criminal hacking was a violation of a duty the company owed to consumers which in turn caused them to suffer loss.