The Government of Canada’s Budget 2021 provides a glimpse into what the future may hold for the proposed federal Data Commissioner. With a mandate to inform government and business approaches to data-driven issues and oversee new regulations for large digital companies, the Commissioner’s work will have significant implications for Canadian businesses whose operations have a data component.

The New Federal Data Commissioner: What We Know So Far

Background

A commissioner is a public officer appointed by statute in order to perform specific public functions. The roles, powers, and responsibilities of commissioners in Canada vary widely. Some have broad investigatory, adjudicative, and sanctioning powers, while others have more limited authority to perform specific, discrete functions. Similarly, some have broad responsibilities requiring significant resources, while others have more limited responsibilities and correspondingly smaller budgets. Commissioners play an important role in Canadian society and, in many respects, the Canadian economy.

In his December 13, 2019 mandate letter to the Minister of Innovation, Science and Industry, the Prime Minister called for the creation of a new federal Data Commissioner to oversee new regulations for “large digital companies” aimed at protecting individuals’ personal data and encouraging greater competition in the digital marketplace. Since then, the government has introduced its long-awaited bill (Bill C-11) for the replacement of Canada’s federal private-sector privacy legislation (the Personal Information Protection and Electronic Documents Act) with the new Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act (see our blog post on the proposed legislation here). However, the government had provided relatively little information about the proposed Data Commissioner.

On April 19, 2021, the government released the Budget. A key theme of the section titled “Helping Canadian Businesses Grow and Succeed” is the need to support the digital economy, including by “better protect[ing] the privacy, security, and personal data of Canadians, [and] building[ing] trust and confidence in the digital economy”. As part of these efforts, the government proposes to create a new Data Commissioner, and the Budget offers some insight into the Data Commissioner’s mandate and budget.

The Data Commissioner’s Mandate: Protecting Canadians’ Data and Encouraging Innovation

The Budget indicates that the Data Commissioner’s mandate will be to “inform government and business approaches to data-driven issues to help protect people’s personal data and to encourage innovation in the digital marketplace”. The twin themes of protecting Canadians’ data and encouraging innovation feature prominently in the Budget’s description of the context within which the Commissioner will perform their work:

Digital and data-driven technologies open up new markets for products and services that allow innovative Canadians to create new business opportunities—and high-value jobs. But as the digital and data economy grows, Canadians must be able to trust that their data are protected and being used responsibly.

The Budget’s Impacts Report similarly highlights the twin themes of protecting Canadians’ data and encouraging innovation, noting that “[a] well-functioning online marketplace and thriving data-driven technology sector benefit all Canadians by ensuring a proper balance with privacy protections and other social considerations”.

In addition, the Impacts Report indicates that one of the Data Commissioner’s focus areas will be the use of data in artificial intelligence (“AI”) systems and, in particular, ensuring that AI systems do not perpetuate biases or historical disadvantages. The Impacts Report observes that “[t]here can be biases in the data used by artificial intelligence systems that inform real life decisions that affect people’s lives, particularly historically disadvantaged demographic groups”, and “[e]fforts by the Data Commissioner to promote positive uses and outcomes associated with data, while identifying and mitigating harmful and negative consequences, are expected to particularly benefit historically disadvantaged groups”.

The Data Commissioner’s Budget

The Budget allocates $17.6 million over five years beginning in 2021/22, and $3.4 million per year going forward, to support the Data Commissioner’s work. To put those numbers in perspective, the Privacy Commissioner of Canada has an annual budget of over $40 million, the Canadian Human Rights Commission has an annual budget of over $25 million, and the Information Commissioner of Canada has an annual budget of over $10 million.

Potential Overlap

It remains to be seen how the Data Commissioner’s work will connect with, complement, or overlap with the work of other commissioners or regulators whose work has a significant data component, not to mention overlaps with rights or remedies available under statutes or the common law. For example, the Data Commissioner’s mandate appears to have some overlap with that of the Privacy Commissioner, which is to oversee compliance with the Privacy Act and the Personal Information Protection and Electronic Documents Act, report on the personal information handling practices of public and private sector organizations, and protect and promote individuals’ privacy rights. As discussed in our earlier blog post, both the federal government (through Bill C-11) and the Quebec government (through Bill 64) propose to use privacy laws to regulate automated decision making. These proposals signal that privacy commissioners will have a role in regulating AI systems — a potential focus area of the Data Commissioner or even private litigants as well. Clarity on the respective spheres of jurisdiction in the areas of data and privacy would be a welcome development for Canadian businesses, which already face a multiplicity of laws and regulations in these areas.

Looking Ahead

Given the increasingly important role of data in the Canadian economy, the Data Commissioner’s work will have significant implications for many Canadian businesses. In the coming months, we expect to see the government release more information about the Data Commissioner and the proposed regulations for large digital companies. As that information becomes available, Canadian businesses should consider the impact on their operations.

To learn more about our Cyber/Data Group, please contact Charles Morgan or Daniel Glover. To receive timely updates, please subscribe to our TechLex blog.