OTTAWA — The Canadian government is set to establish a new digital regulator designed to enforce online safety and privacy rules while assuming oversight responsibility for technology companies currently held by the privacy commissioner. This initiative aims to address growing concerns about online harms and provide a unified regulatory framework.
In June 2023, the Liberal government unveiled two significant pieces of legislation: Bill C-34, which is centered on digital safety, and Bill C-36, focusing on privacy issues. Bill C-34 mandates social media platforms to temporarily restrict access for children under 16 and imposes a duty of care on AI chatbot developers, ensuring they act responsibly. On the other hand, Bill C-36 raises standards for companies managing children's data, grants Canadians the right to request the deletion of their information, and requires transparency regarding the use of automated decision-making processes for critical individual decisions.
Both pieces of legislation will be administered by the new Digital Safety and Data Protection Commission of Canada, which will consist of five members appointed by the cabinet. Government officials project that the establishment of this new regulator will take around 18 months.
The proposed commissioner will have extensive powers, including the ability to issue binding orders and impose fines up to $10 million or three percent of a company's gross global revenue. For serious violations, such as interference with the commission's work, fines could reach $25 million or five percent of global revenue. The commission will also determine important aspects of implementing new digital safety regulations, such as evaluating the effectiveness of age-verification methods used by companies and assessing whether social media platforms qualify for exemptions concerning age restrictions.
Michael Geist, a law professor at the University of Ottawa, has labeled this commission as a "digital super-regulator," emphasizing its comprehensive oversight responsibilities that encompass both online speech and content moderation, along with personal information management by organizations. In a blog post, Geist highlighted the potential for the commission to wield "astonishing powers" that could be unrivaled in democratic nations.
Heidi Tworek, a history and public policy professor at the University of British Columbia, noted that Canada’s integrated approach stands in contrast to international norms, where distinct regulators typically oversee privacy and online safety. She referenced Australia’s precedent in establishing a safety commission prior to implementing social media restrictions for children, suggesting that Canada’s simultaneous establishment of the new commission alongside legislation is groundbreaking.
Defending the consolidation of regulatory functions, government officials have indicated that a single commission would provide Canadians with a clear point of contact regarding issues related to children's safety and data privacy. Teresa Scassa, a law professor at the University of Ottawa, suggested that the government is leveraging synergies between various digital regulation challenges by centralizing authority in one agency. Taylor Owen, founding director of the Centre for Media, Technology and Democracy at McGill University, argued that having a powerful regulator might be essential for effectively overseeing some of the largest technology companies globally.
However, the transition of regulatory powers from the privacy commissioner to the new commission has raised significant concerns among experts. Under the proposed privacy legislation, the responsibility for overseeing the private sector, including tech companies, would shift from the privacy commissioner to the Digital Safety and Data Protection Commission, leaving the privacy commissioner responsible solely for government actions. Florian Martin-Bariteau, a research chair at the University of Ottawa, expressed his reservations about merging these responsibilities, emphasizing that the existing privacy commission has proven effective and maintains a strong reputation.
Scassa highlighted potential motivations behind the transition, suggesting that the government prefers a regulatory body with more control over its operations compared to the independence enjoyed by the privacy commissioner. She warned that the merging of these distinct regulatory frameworks could lead to a chaotic transition period during which privacy rights may not be adequately protected. The consolidation of power into a newly established entity raises important questions about the potential loss of expertise and the safeguarding of privacy in Canada.
