On June 16, 2022, the Canadian government introduced Bill C-27, which introduced three Acts meant to modernize federal privacy laws. I reviewed the Consumer Privacy Protection Act (“CPPA”) in a previous blog, and I’m now going to focus on the Personal Information and Data Protection Tribunal Act, found in Part 2 of Bill C-27.
The Personal Information and Data Protection Tribunal (the “Tribunal”) will have jurisdiction over all appeals regarding a decision following an inquiry, a compliance order, and the recommendation of administrative penalties for contravention of the CPPA, made by the Privacy Commissioner. Importantly, at least three members of the Tribunal must have experience in the field of information and privacy law.
Hearings to be held by the Tribunal will be less formal than court proceedings. Subject only to privilege, the Tribunal is not bound by any legal or technical rules of evidence in relation to any matter that comes before it. The Tribunal must deal with all matters as informally and expeditiously as the circumstances and considerations of fairness and natural justice permit.
The hearings will be held in public unless the Tribunal determines that it would not be in the public’s interest or if confidential information may be disclosed, and ensuring that it is not disclosed outweighs the desirability of having public hearings. The Tribunal must provide a decision, with reasons, in writing to all parties to a proceeding, and the decision will be publicly available.
Bill C-27 provides that the Tribunal may make rules to govern the management of its affairs and the practice and procedure with regard to hearings. While not a mandatory requirement, the Tribunal will need a code of practice in order to operate efficiently and to ensure that matters are dealt with fairly and expeditiously.
The Tribunal will have all the powers, rights, and privileges that are vested in a superior court, with respect to the appearance, swearing and examination of witnesses, the production and inspection of documents, the enforcement of its decisions, and other matters necessary or proper for the due exercise of its jurisdiction. The Tribunal will have the power to award costs.
A decision of the Tribunal will be final and binding, and subject only to judicial review under the Federal Courts Act. A Tribunal decision can be made an order of the Federal Court or a provincial/territorial superior court for enforcement purposes.
The idea of a Tribunal dedicated to privacy law is a welcome one. Having an administrative body that has expertise in information and privacy law to determine appeals from decisions of the Privacy Commissioner will hopefully result in timely decisions, which provide nuanced guidance to businesses (and the Office of the Privacy Commissioner) on how privacy law will be interpreted, and how it is to be applied. Of some concern, however, is that the Tribunal is to be comprised of only three to six members, some of whom can be part-time members. With privacy being a growing concern for individuals and increased powers being granted under the CPPA to the Privacy Commissioner regarding enforcement, the Tribunal may quickly become under-resourced.