OTTAWA The Canadian government has unveiled plans for a comprehensive new digital regulator that aims to enforce online safety and privacy rules while also taking control over the oversight of technology companies from the current privacy commissioner. This proposal has sparked a debate among critics, with some labeling it a "super-regulator," while others highlight the urgent need for a strong regulatory body to address the growing harms associated with online activities.
What has the government proposed?
In June, the Liberal government introduced two significant pieces of legislation focused on technology policy: Bill C-34, which concentrates on digital safety, and Bill C-36, which pertains to privacy issues. Bill C-34 mandates social media platforms to temporarily block access for children under 16 and also seeks to impose responsible conduct requirements on AI chatbot companies. Conversely, Bill C-36 aims to establish enhanced standards for organizations managing children's data, grant Canadians the right to request data deletion, and ensure transparency in the use of automated decision-making processes concerning individuals.
Both bills will fall under the jurisdiction of the new Digital Safety and Data Protection Commission of Canada, which will consist of five members appointed by the cabinet. Government officials anticipate that this new regulatory body will take about 18 months to become operational.
What powers would the new regulator have?
The commission will have the authority to issue binding orders to organizations and can impose fines of up to $10 million or three percent of the organization’s gross global revenue. For severe infractions, such as obstructing the commission’s work, fines could escalate to $25 million or five percent of global revenue. The regulator is also responsible for making critical decisions on implementing the new digital safety rules, including evaluating the effectiveness of age-verification methods and determining whether social media platforms should receive exemptions from the age ban.
Michael Geist, a law professor at the University of Ottawa, has referred to this commission as a "digital super-regulator" due to its expansive authority. He articulates concerns regarding the extensive scope of responsibilities, which would encompass regulating online speech and content moderation, as well as overseeing how organizations collect, use, and disclose personal information.
How unusual is the new proposed set-up?
Geist has noted that the powers allocated to the new regulator might be unparalleled in the democratic world, while Heidi Tworek, a professor at the University of British Columbia, highlighted Canada's unusual approach compared to international norms that typically separate privacy regulation from online safety oversight. She pointed out that Australia had already established a safety commission when it implemented its social media restrictions, contrasting it with Canada's simultaneous setup and legislation launch.
The case for a strong regulator
Government officials maintain that having a single commission dedicated to both digital safety and privacy will simplify interactions for Canadians engaging with private-sector companies, particularly concerning children's safety and data management. Teresa Scassa, a law professor at the University of Ottawa, remarked that the government likely perceives overlaps and synergies in the digital regulation landscape and seeks to address these through a unified body. Taylor Owen, founding director of the Centre for Media, Technology and Democracy at McGill University, expressed provisional support for the idea of a powerful regulator, arguing that the regulation of large, influential companies is essential.
What's the issue with the new commission taking powers from the privacy commissioner?
Under Bill C-36, the new commission will assume responsibility for the private sector, including tech companies, while the privacy commissioner will be limited to overseeing the Privacy Act related to government functions. This shifting landscape raises concerns among several experts. Florian Martin-Bariteau, a research chair in technology and society, cautioned against merging the privacy commissioner’s responsibilities with the new entity, noting that the existing office operates effectively and has a strong reputation.
Scassa echoed these sentiments by indicating that the privacy commissioner operates as an independent agent of Parliament, limiting governmental influence over its actions. Consequently, the government might exert more control over the newly proposed commission, which raises concerns about the potential degradation of privacy rights. Scassa cited the substantial experience and international standing of the privacy commissioner’s office, arguing that the transitional phase to a new regulatory body could result in a period of confusion that inadequately serves citizens' privacy rights.
