Are Canada’s privacy laws sufficient to protect consumers from the use of personal data by companies like Google and Facebook?

Answer

Are Canada’s privacy laws sufficient to protect consumers from the use of personal data by companies like Google and Facebook?

Some of the various freedoms enumerated in the Canadian Charter of Rights and According to Dyke, freedoms include the right to life and liberty, security, and the protection against not only unreasonable search and seizure but also an unreasonable invasion of privacy (138). The courts in Canada have placed heavy reliance on the Canadian Charter of Rights and Freedoms as a safeguard against the unreasonable invasion of privacy (Law Library of Congress para 6). However, personal data protection is the subject of the Personal Information Protection and Electronic Documents Act (PIPEDA) at the federal level. Despite PIPEDA adopting ten privacy principles as well as recommended practices to regulate privacy, it is weak in both its oversight and enforcement mechanism and hence insufficient in the protection of consumers from the use of personal data by companies such as Google and Facebook.

            The importance of the protection of the personal data of consumers was underscored by the Supreme Court in R. v. Dyment [1988] where it stated that the state has come to the realization that privacy is the heart of any democracy and its essential for their wellbeing of the individuals. PIPEDA has adopted ten critical principles which related to the aspects of consent, transparency, security measures, and data retention (Dyke 140). The application of the provisions of PIPEDA is on the online activities of companies including Google and Facebook. Despite this, however, there exist no specific rules in the Act which regulates the use of social networks, apps in smartphones, and other online activities. Additionally, the law does not have any specific provisions which seek to protect the data of the minors. The two functions of PIPEDA which are both oversight and enforcement are shared between the Federal Court of Canada and the Privacy Commissioner of Canada. In specific, the Privacy Commissioner of Canada has the role of investigating any complaints brought about on breach of privacy, auditing the practices of personal information by organizations, and reporting any violations to PIPEDA (Rosenstock 10). The Canadian Federal Court, on the other hand, is tasked with the ordering organizations to comply with the Act, making any corrections, and even awarding damages.

            PIPEDA was passed in 2000 by the Canadian parliament and in its preamble, it seeks to not only support but also promote electronic commerce via the protection of personal information which is collected, used, and disclosed in the course of commercial transactions. It is critical to note that PIPEDA is only applicable in the private sector. PIPEDA has two divisions with the first being the regulation of the collection, use, and disclosure of personal information while the second part deals with the electronic documents and evidence (Rosenstock 11). Under the Act, personal data is defined as information which can be used to identify an individual but does not include name, title, telephone number or business address. The principle of consent under PIPEDA requires that organizations such as Facebook and Google seek the knowledge and consent of the individuals in the collection, use, and disclosure of their information. Moreover, under identifying purposes, organizations are required to identify the purpose for which the personal information is collected before the time of collection (Reynolds et al. 213). The protection of public data is, however, under the Privacy Act 1980 which regulates the collection, use, and disclosure of personal data and information by public or government bodies.

            Despite the two pieces of legislation seeking to ensure that personal information of individuals is protected from use by companies such as Google and Facebook, there is no sufficient protection considering the manner in which the oversight and enforcement strategies are weak. Additionally, according to Reynolds et al., the general provisions of the PIPEDA have not been enough to ensure that companies cannot exploit personal information for their own gains (214). For instance, the definition of consent is inadequate as some people cannot understand the nature, purpose, and consequences of the collection, use, or even disclosure of their personal information (Dyke 139). Additionally, organizations such as Facebook and Google are not required to report any material breach of any security safeguards by third parties involving personal data which is under their control (Law Library of Congress para 12). As a result, in the case of a data breach by a third party, the companies cannot be held accountable.

In conclusion, although Canada has adopted the Privacy Act 1980 and PIPEDA to protect personal data from use by companies such as Google and Facebook, the provisions of the two legislations are weak whereas the oversight and enforcement mechanisms are insufficient to protect the personal data of individuals. PIPEDA is pegged on the principles of accountability, transparency, and consent, among others. Organizations such as Google and Facebook are not under any legal obligation to report any third-party data breaches of information within their control. As such, the consumers cannot feel protected by the two pieces of legislation as third-party breaches can occur without any protection or reprieve.