Vol. 150, No. 8 — April 20, 2016

Registration

SOR/2016-63 March 29, 2016

PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT

Regulations Repealing the Regulations Specifying Investigative Bodies (Miscellaneous Program)

P.C. 2016-162 March 24, 2016

His Excellency the Governor General in Council, on the recommendation of the Minister of Industry, pursuant to subsection 26(1) (see footnote a) of the Personal Information Protection and Electronic Documents Act (see footnote b), makes the annexed Regulations Repealing the Regulations Specifying Investigative Bodies (Miscellaneous Program).

Regulations Repealing the Regulations Specifying Investigative Bodies (Miscellaneous Program)

Repeal

1 The Regulations Specifying Investigative Bodies (see footnote 1) are repealed.

Coming into Force

2 These Regulations come into force on the day on which they are registered.

REGULATORY IMPACT ANALYSIS STATEMENT

(This statement is not part of the Regulations.)

Issues

The coming into force of recent amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA), under the Digital Privacy Act (S.C. 2015, c. 32), removed the sections of the Act specifying exceptions for “investigative bodies.” The purpose of the Regulations Specifying Investigative Bodies was to designate organizations as “investigative bodies” that were permitted to make use of these two exceptions to consent. With the repeal of these exceptions under PIPEDA, the Regulations Specifying Investigative Bodies are spent.

Background

When Parliament first enacted PIPEDA, it established a set of privacy rules that recognize individuals’ right of privacy while accommodating organizations’ need for information in reasonable and appropriate circumstances. Prior to the amendments made under the Digital Privacy Act, PIPEDA allowed private sector organizations to disclose personal information without consent to allow specific organizations, designated as “investigative bodies” in the Regulations, to investigate breaches of agreement and contraventions of the law. Investigators had to be listed as an “investigative body” in the Regulations to make use of two specific legislative provisions, which permitted the disclosure of personal information without consent [former paragraphs 7(3)(d) and 7(3)(h.2)].

The amendments made under the Digital Privacy Act followed a recommendation from the House of Commons Standing Committee on Access to Information, Privacy and Ethics (the Committee) during the first statutory review of PIPEDA. The Committee recommended that the “investigative bodies” designation process be replaced with a definition of “investigation.”

The Digital Privacy Act, which came into force on June 18, 2015, repealed paragraphs 7(3)(d) and 7(3)(h.2) of PIPEDA. As a result of these amendments, organizations no longer need to be designated as an “investigative body” in the Regulations under PIPEDA to be able to collect, use or disclose personal information without consent when conducting investigations. Consequently, the Regulations Specifying Investigative Bodies made under PIPEDA are of no effect, as the corresponding exceptions to consent for “investigative bodies” in these sections were repealed. The Regulations Specifying Investigative Bodies are, therefore, spent and can be repealed.

Objectives

The objective of this proposal is to repeal the Regulations Specifying Investigative Bodies, which are spent.

Description

The Regulations Repealing the Regulations Specifying Investigative Bodies (Miscellaneous Program) will repeal the Regulations Specifying Investigative Bodies.

“One-for-One” Rule

The “One-for-One” Rule applies, as the Regulations Specifying Investigative Bodies are being repealed and this is considered to be an “OUT.” There is no change in administrative burden associated with this repeal because the Regulations are spent.

Small business lens

The small business lens does not apply, as the proposal does not impose a cost on small businesses.

Consultation

As the Regulations Specifying Investigative Bodies are spent as a result of the amendments made under the Digital Privacy Act, no further consultations have been undertaken.

Rationale

Effective June 18, 2015, the Regulations Specifying Investigative Bodies made under PIPEDA have no effect, as the corresponding exceptions to consent for investigative bodies found in paragraphs 7(3)(d) and 7(3)(h.2) of PIPEDA have been repealed. In place of these provisions, the Digital Privacy Act added the following new provision to PIPEDA:

These amendments implement a recommendation made by the House of Commons Standing Committee on Access to Information, Privacy and Ethics during the first statutory review of PIPEDA, completed in May 2007. In its report, the Committee recommended that PIPEDA be amended to replace the “investigative bodies” designation process with a definition of “investigation” similar to that found in the Alberta and British Columbia personal information protection acts, thereby allowing for the collection, use and disclosure of personal information without consent for these purposes. In its response to the Committee, the Government agreed that the original framework in PIPEDA was lengthy and cumbersome for applicants and inconsistent with approaches taken in the provinces, and committed to streamline PIPEDA’s provisions in respect of private sector investigative activity.

As a result of these amendments, organizations no longer need to be designated an “investigative body” in the Regulations under PIPEDA to be able to collect, use or disclose personal information without consent when conducting investigations. In fact, any private organization may collect, use or disclose personal information without consent when conducting investigations or anti-fraud activities, provided that the conditions set out in paragraphs 7(3)(d.1) and 7(3)(d.2) are satisfied.

With the amendment of PIPEDA by the Digital Privacy Act, organizations investigating contraventions of the law or breaches of agreement no longer have to seek regulatory approval to obtain personal information when conducting investigations.

Organizations that exchange personal information for investigative purposes will remain responsible for compliance with all other requirements of PIPEDA, and will be subject to oversight by the Privacy Commissioner of Canada; individuals will also have the ability to seek redress in the Federal Court of Canada. The general requirement to obtain consent before disclosing personal information is not altered.

Through the establishment of these conditions, the Government’s intention is to replace the previous regulatory vetting process for the designation of investigative bodies with exceptions to consent that will permit personal information to be used for legitimate investigations. The Government’s intention is that any disclosure that was legally permitted to or from an investigative body previously will continue to be permitted by organizations under the amended Act.

Following the coming into force of these recent amendments to the PIPEDA, the Regulations Specifying Investigative Bodies are spent. The purpose of the Regulations Specifying Investigative Bodies was to designate organizations as “investigative bodies” that were permitted to make use of two exceptions to consent. However, the exceptions to consent for “investigative bodies” have been repealed. On this basis, Industry Canada has concluded that the Regulations Specifying Investigative Bodies should be repealed.

Contact

John Clare
Director
Privacy and Data Protection Policy
Digital Policy Branch
Spectrum, Information Technologies and Telecommunications
Industry Canada
235 Queen Street, 1st Floor
Ottawa, Ontario
K1A 0H5
Telephone: 343-291-3796
Fax: 343-291-3802
Email: john.clare@canada.ca