Privacy Commissioner Requires Revamp Of Privacy Policies

"I consent (subject to what the Privacy Commissioner deems meaningful)": A blueprint for the private sector on meaningful consent for 2019.

"Informational privacy is often equated with secrecy or confidentiality ... Privacy also includes the related but wider notion of control over, access to and use of information" - R. v. Spencer, 2014 SCC at paras. 39 and 40.

With the coming into force of the Guidelines on Meaningful Consent the "Guidelines" on January 1, 2019, private sector companies operating within Canada may need to fundamentally alter their practices and redraft their policies to be compliant with law.

According to the Guidelines issued by the Office of the Privacy Commissioner of Canada the "OPC", obtaining meaningful consent will require greater transparency about how data is collected, used and disclosed. The OPC also has emphasized that "express consent" is the default, and that implied consent will only be appropriate in limited circumstances.

Today, consent must be informed, voluntary and meaningful - but what does this actually mean?

Meaningful consent is informed by context, leaving organizations with the generic response "it depends on the circumstances". However, what seems clear is that the OPC will not accept policies that use "legalese" and will require companies to go beyond fine print that few consumers have the time, energy, interest or desire to read.

While it is not possible to know exactly what the OPC will require until the Guidelines are applied and interpreted, private sector organizations should review their policies and practices now with a view to implementing the best practices that the OPC has mandated.

The background: "Reasonable expectation of privacy" and "meaningful consent" in Canadian Law

In an age where the collection, use and disclosure of personal information from consumers is considered axiomatic for the development of businesses, the meaning of "consent" to collect, use and disclose has become more muddled than one would hope.

Given the ease and pace at which information is shared, one might argue that the breadth of information available to companies suggests that consumers have voluntarily relinquished control over the information they disclose.

To the contrary, this theory was laid to rest by the Supreme Court of Canada, which recognizes that informational privacy includes the "wider notion of control over, access to and use of information".1

Relatedly, the Supreme Court of Canada has recently issued several decisions in the criminal law context that address reasonable expectations of privacy and provide an overarching framework for issues such as the scope of implied consent and when an individual will be considered to...