Browse All Strategic Priorities
Consumer data privacy is now a business imperative for all brands, and a critical advocacy point for ACA. Canada has been a leader in consumer privacy legislation since 2000, when the government introduced the Personal Information Protection and Electronic Documents Act (PIPEDA). We are one of only 12 countries whose privacy regulations are deemed “adequate” under the EU’s General Data Protection Regulation (GDPR).
The Current Landscape
In recent years high-profile data breaches have caused consumers to become more aware of the data they share with companies. This, in concert with the General Data Protection Regulation (GDPR) and the California Privacy Act (CCPA), has fueled Canada’s federal and provincial regulators to revisit their existing privacy legislation and regulations or consider enacting new ones, raising the stakes for all brands. Indeed, we are seeing privacy reform globally — a “second-generation” of privacy reform — in which digital consumer privacy is of keen focus.
While ACA staunchly believes in the privacy of the consumer and the opportunity for modernization of current privacy policies, care must be taken to ensure the measures do not stymie business. Privacy legislation should be adaptable and consistent to avoid a complicated patchwork of solutions, and should support innovation.
Additionally, the marketing industry is faced with the end of third-party cookies and the ability to target consumers using unique identifiers, all under the aegis of privacy. Apple’s user privacy regulations for iOS 14 and Google’s ending of third-party cookies in Chrome have and will continue to significantly impact how advertisers target.
The ACA believes that every brand must have a robust data protection and privacy practice, as it has become a central part of consumer brand trust.
Related Resources
(November 18, 2021) – The State of Identity in Online Advertising: A Focus on Canada (video recording of event)
(April 27, 2020) – The consumer-data opportunity and the privacy imperative (McKinsey & Co.)
At Issue
Apple Does Away With IDFA
In April 2021 Apple implemented sweeping changes to iOS 14, including a feature dubbed App Tracking Transparency (ATT), which prompts users to opt into app tracking on an app-by-app basis. As predicted, opt-in rates have been extremely low, preventing apps from collecting data from a large portion of their users, and stymying advertisers’ ability to target advertising based on user demographics.
Apple’s iOS 15 update continued the trend toward increased privacy for their consumers. The changes included features that mask email and internet addresses of Apple customers, making them less effective as a unique identifier for online tracking.
ACA Action
Following the release of the iOS 14 news, ACA drafted a letter to Apple together with the Canadian Media Directors Council (CMDC). The letter outlined concerns about the impact of the changes on the entire media ecosystem. The letter further appealed to Apple to listen to the concerns of all industry stakeholders to develop a solution that would protect consumer privacy while preserving a robust ad-supported digital marketplace.
The ACA has a keen eye on how Apple’s continued changes are affecting members’ targeting and personalization efforts within mobile advertising and email on Apple devices. Our staff are on hand to support members in their efforts to adapt to these changes.
This icon means you must be an ACA member to view this content.
Related Resources
Google Kills Third-Party Cookie
In January 2020 Google announced on its blog that it would do away with third-party cookies with the aim of providing more privacy for consumers and to build back consumer trust.
In July 2021, Google announced that it would delay their plan to remove support for third-party cookies to the third quarter of 2023, stating: “…it’s become clear that more time is needed across the ecosystem to get this right.” Google shared a timeline for implementation on their blog.
Google proposed the Federated Learning of Cohorts (FLoC) in 2021, but due to privacy concerns went back to the drawing board. In early 2022 it debuted a new solution, Topics, which takes a topic-based approach to targeting web users, with up to 5 topics per user at one time. More information about Topics can be found on Google’s blog.
In February 2022, Google also made another significant announcement, stating that they would be taking their Privacy Sandbox to the Android mobile operating system, similar to Apple’s IDFA. Google says it will continue to support its existing ad platforms for at least two years while trying to provide ample prep time for changes.
ACA Action
Google has promised to work with parties that could be impacted by the privacy changes to its Android OS. ACA will maintain a close watch on developments, with a view to voicing any concerns on behalf of its members to Google.
ACA is also monitoring the testing Google is doing on Topics and will explore other proposed alternative solutions.
Bill C-11 (Federal)
In November 2020, the federal government announced its intention to update our federal data privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), which has been in effect since 2001. Bill C-11, the Digital Charter Implementation Act, 2020, was an attempt to modernize Canada’s existing private sector privacy law.
The aim of this new modernized framework was – according to the government – to increase control and transparency when Canadians’ personal information is handled by companies, and would have included the strongest fines among G7 privacy laws.
With the call of the Federal election, Bill C-11 died on the order paper. However, Innovation, Science and Economic Development Canada (ISED) will bring forth a new bill which will be informed by Bill C-11.
ACA Action
The contents of a new bill will need to be considered by each organization carefully once it is brought forth. The ACA encourages its members to engage early on with in-house counsel, external counsel, compliance teams and/or privacy committees to understand the impact of proposed privacy legislation on organizational marketing practices. The ACA will reach out to ISED to advocate on behalf of marketers.
ACA does not anticipate a new bill to be fully enacted any earlier than 2024.
Related Resources
(January 12, 2021) – What Marketers Need to Know about Bill C-11, An Update to Canada’s Federal Privacy Law – ACA blog
Bill 64 (Quebec)
In June 2020, the Quebec government tabled Bill 64, An Act to modernize legislative provisions [regarding] the protection of personal information, which includes significant proposed amendments to an Act Respecting the Protection of Personal Information in the Private Sector (the Quebec Privacy Act). A number of the requirements proposed are similar to those within the European Union’s General Data Protection Regulation (GDPR). However, many are more rigorous, and are unique to the province of Quebec.
The ACA prepared a comprehensive submission* to the government on December 2, 2020, which raised key concerns, including:
- the redundancy and complexity of consent provisions
- the premature requirement for data portability
- punitive sanctions and excessive financial penalties.
*Read the full submission in the Resources section below.
Following the feedback submitted by ACA and other industry stakeholders some adjustments were made to the Bill, including:
- clarity and simplification around consent
- the relaxation of some measures related to data portability
- a further clarification of the definition of personal information
The Bill received Royal Ascent on September 22, 2021. The Act will enter into force in three stages, with provisions coming into force over a three-year period, beginning on September 22, 2022.
Members can read the October 1, 2021 Member Alert (listed in the Resources section below) for a list of actions they should take immediately in order to prepare.
This icon means you must be an ACA member to view this content.
Related Resources
Ontario Privacy Law
Ontario does not currently have a general privacy law that applies to private-sector businesses and organizations. In August 2020, the Government of Ontario launched a consultation to consider improvements to its privacy laws.
ACA Action
In October 2020, ACA submitted a comprehensive paper addressing key areas of reform.
Following a round of input, Ontario submitted a revised whitepaper in June 2021. The whitepaper considers several enhanced requirements for businesses, including:
- Changes to consent requirements
- New limits on data collection, use and disclosure
- Special obligations for AI systems
- New approach to data use in research
- Consideration to expand the role of the IPC
It is clear that large parts of the whitepaper were drafted in a way that mimics the Federal government’s Bill C-11, with certain areas that will be unique to Ontario. ACA does not expect new legislation to be announced until after the election in June 2022.
Related Resources
Personal Information Protection Act (British Columbia)
The B.C. Government formed a special committee in June 2020 to review its Personal Information Protection Act (PIPA). In a Briefing Note, the Office of the Information and Privacy Commissioner for British Columbia (OIPC) confirmed that it would like to see PIPA more closely aligned with other Canadian and international privacy legislation, including the General Data Protection Regulation (GDPR) in the European Union.
In December 2021, the Committee released its report Modernizing British Columbia’s Private Sector Privacy Law. The report outlined several guiding values, including establishing privacy as a right, adaptability with new technologies, supporting innovation, and consistency with other legislation both locally (provincial and federal) and internationally. The report also suggests that the Commissioner’s enforcement powers be strengthened to enforce compliance. The aim is to make the new Act a second-generation PIPA.
ACA Action
ACA is keeping a close eye on developments regarding PIPA and will intervene if necessary.
Alberta’s Personal Information Protection Act
In November 2020, Alberta’s Information and Privacy Commissioner proposed amendments to Alberta’s Personal Information Protection Act (Alberta PIPA) to the Minister of Service Alberta. The Commissioner, Jill Clayton, proposed that her office be granted authority to levy administrative monetary penalties and suggested that fines for offences be increased to mirror other Canadian jurisdictions.
In the summer of 2021, Service Alberta undertook a consultation to update the Alberta PIPA.
ACA Action
It is unclear when the Government is likely to introduce a bill reforming Alberta PIPA, but ACA is keeping tabs on progress and will inform members of any significant developments.