The Ontario government has launched a public consultation process on a proposed “Ontario-made” privacy legislation which, if enacted, is expected to apply to private sector, provincially-regulated employers. Written submissions from the public and impacted businesses will be accepted until October 1, 2020, and virtual town hall meetings to discuss the potential changes will be held in early October.
As part of the consultation process, the government published a companion discussion paper that identified several areas of improvement that the new legislation is intended to address, including:
- Increased transparency with respect to how an individual’s information is being used by businesses and organization;
- Improved consent provisions, including allowing for revocations at any time, and adopting an “opt-in” model for secondary uses of information;
- The right for individuals to request deletion or deindexing of personal information (the right to be forgotten);
- The right for individuals to obtain their data in a standard and portable digital format (data portability);
- Oversight, compliance and enforcement powers for the Information and Privacy Commissioner (IPC) to support compliance with the law;
- The use of anonymized data;
- The inclusion of non-commercial organizations in privacy laws, including not-for-profits, charities, trade unions and political parties; and
- The use of modern compliance support mechanisms, such as data trusts.
Filling Gaps in Ontario’s Current Privacy Laws
The proposed legislation aims to fill gaps in Ontario’s existing privacy laws. Currently, provincial privacy laws only cover personal information held by government institutions and specific health care providers. In the absence of specific provincial laws, private sector organizations operating in Ontario are partly governed by the federal Personal Information Protection and Electronic Documents Act [PIPEDA].
PIPEDA, however, is limited in scope and applies only in respect of personal information collected in the course of commercial activities by federally regulated organizations (such as banks, airports and airlines, telecommunication companies, and businesses related to interprovincial transportation). PIPEDA does not apply to information collected by provincially regulated organizations, or information unrelated to commercial activities. Consequently, the collection, use and disclosure of personal information by most businesses in Ontario are not governed by any specialized privacy legislation, although privacy-related requirements may still arise from the common law, as well as from employment agreements and other contracts (see, for example, our blog post on Jones v Tsige, in which the Ontario Court of Appeal recognized the common law tort of “intrusion upon seclusion”, or invasion of privacy).
Considerations for Employers
Employers should turn their attention to privacy practices currently in effect in the workplace and ensure they are compliant with their common law, contractual, and potentially emergent statutory privacy obligations. Especially as workplaces adapt to the realities of COVID-19 and shift operations to work-from-home arrangements and digital platforms, employers should assess their ability to adapt to any new rights and obligations created if a provincial private-sector privacy legislation enters into force.
It will be some time before any legislation may be introduced as a result of this consultation process, and at this stage it is not certain that any legislation will be introduced. However, any legislation introduced as a result of this process would likely include new requirements with regard to the collection, disclosure and use of employee personal information by employers, given that a stated aim of the consultation process is to fill gaps within the existing legislative framework when it comes to privacy.
Employers may wish to participate in the consultation process. The government is accepting input by way of written submissions or an online survey until October 1, 2020. Employers may also register for virtual town hall sessions, to be held in early October.
As always, we will monitor the progression of these and other privacy-related developments affecting employers and post further updates as they become available to keep you In the Know.
This blog is provided as an information service and summary of workplace legal issues.
This information is not intended as legal advice.
