Bill S-4 explained in plain English

Bill S-4, the Digital Privacy Act, updates Canada's federal privacy law to require organizations to notify people of data breaches, clarify consent rules, permit information sharing in specific situations like fraud prevention and business transactions, and give the Privacy Commissioner new compliance tools.

Bill S-4, called the Digital Privacy Act, amends the Personal Information Protection and Electronic Documents Act (PIPEDA), which is Canada's main federal privacy law for private-sector organizations. The bill received royal assent on June 18, 2015. The main changes are: **What organizations can do with personal information:** - Organizations can now collect, use, or share personal information without consent in specific situations, such as identifying injured or deceased people, preventing fraud, protecting victims of financial abuse, handling insurance claims with witness statements, and managing employment relationships at federal businesses. - Organizations involved in buying, selling, or merging with other organizations can share personal information during these business deals without consent, if they have agreements in place to protect that information. **Consent rules:** - The bill clarifies what "valid consent" means: a person must reasonably be expected to understand the nature, purpose, and consequences of sharing their personal information. - Business contact information (like work email, phone number, or job title) is excluded from PIPEDA's rules when used only to communicate with someone about their job or business. **Data breaches:** - Organizations must now keep a written record of all security breaches involving personal information. - If a breach creates a real risk of significant harm (such as identity theft, financial loss, or damage to reputation), organizations must notify affected individuals as soon as possible, and report the breach to the Privacy Commissioner. - Organizations must also notify other organizations or government agencies if they could help prevent harm from the breach. **Privacy Commissioner powers:** - The Privacy Commissioner can now enter into "compliance agreements" with organizations to ensure they follow privacy rules, instead of always going to court. - The Commissioner can share information about breaches with government agencies if it relates to investigating law-breaking. - Individuals can apply to Federal Court for a hearing within one year after receiving the Commissioner's report (extended from an earlier period). **Employment:** - Federal businesses (like banks and Crown corporations) can collect, use, or share employee personal information without consent if necessary to establish, manage, or end employment relationships, provided they inform employees in advance. **Protections for whistleblowers:** - Employees are protected if they report privacy violations to the Privacy Commissioner in good faith. **Access to Information:** - PIPEDA is added to the Schedule of the Access to Information Act, which may make certain information about PIPEDA subject to access requests. The bill also makes technical changes to French-language provisions and corrects definitions related to banks and other federal businesses.

A Legislative Summary is currently being prepared for this bill by the Parliamentary Information and Research Service of the Library of Parliament. A pre-release version of this publication is available to parliamentarians and their staff, and can be obtained by submitting a request or contacting the Library of Parliament. Meanwhile, the following executive summary is available. On 8 April 2014, the Leader of the Government in the Senate introduced Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act (Digital Privacy Act) in the Senate and it was given first reading. Bill S-4 amends the Personal Information Protection and Electronic Documents Act to, among other things (a) specify the elements of valid consent for the collection, use or disclosure of personal information; (b) permit the disclosure of personal information without the knowledge or consent of an individual for the purposes of (i) identifying an injured, ill or deceased individual and communicating with their next of kin, (ii) preventing, detecting or suppressing fraud, or (iii) protecting victims of financial abuse; (c) permit organizations, for certain purposes, to collect, use and disclose, without the knowledge or consent of an individual, personal information (i) contained in witness statements related to insurance claims, or (ii) produced by the individual in the course of their employment, business or profession; (d) permit organizations, for certain purposes, to use and disclose, without the knowledge or consent of an individual, personal information related to prospective or completed business transactions; (e) permit federal works, undertakings and businesses to collect, use and disclose personal information, without the knowledge or consent of an individual, to establish, manage or terminate their employment relationships with the individual; (f) require organizations to notify certain individuals and organizations of certain breaches of security safeguards that create a real risk of significant harm and to report them to the Privacy Commissioner; (g) require organizations to keep and maintain a record of every breach of security safeguards involving personal information under their control; (h) create offences in relation to the contravention of certain obligations respecting breaches of security safeguards; (i) extend the period within which a complainant may apply to the Federal Court for a hearing on matters related to their complaint; (j) provide that the Privacy Commissioner may, in certain circumstances, enter into a compliance agreement with an organization to ensure compliance with Part 1 of the Act; and (k) modify the information that the Privacy Commissioner may make public if he or she considers that it is in the public interest to do so.