Privacy commissioner aims to strengthen Alberta's personal information protection laws (2024)

The office of Alberta’s privacy commissioner is recommending the province update and toughen a two-decade-old piece of legislation that governs how personal information is used by the private sector.

The Personal Information Protection Act (PIPA) came into force in 2004 and was last significantly amended in 2010.

It sets out a framework for private sector organizations to collect, use and disclose personal information. It also spells out the rights individuals have to request access to their own information.

Article content

Citing substantial technological changes in the two decades since the act was created, the Office of the Information and Privacy Commissioner has submitted an 84-page report with recommendations to the Alberta legislature’s Standing Committee on Resource Stewardship.

“Dramatically expanded use of cellphones, apps, social media and online shopping has created a world in which technology touches everything we do. Vast amounts of personal information are shared by individuals and collected, used and disclosed by private sector organizations, mostly for profit,” said privacy commissioner Diane McLeod.

“PIPA needs to be amended to protect Albertans’ privacy in our evolving information-based society, while also enabling commerce, especially where it relates to the development and deployment of innovative technologies.”

The report makes 47 recommendations spread across 25 subsections of the act.

Those include recognizing the protection of personal information as a fundamental human right, given what it terms “the current digital environment and the risks to the protection of PI in the digital economy.”

Article content

Article content

The recommendations also include the so-called “right to be forgotten,” something not mentioned in the legislation’s current form.

“Including these rights in PIPA is key to balancing the significant power that organizations, and in particular large technology companies, hold over the publication and dissemination of individuals’ personal information online.”

It also calls for tougher enforcement mechanisms in the act, which currently allows the commissioner to issue an order compelling an organization to do what the law requires in the first place.

That isn’t strong enough, McLeod’s office stated, calling for fines to be brought into line with the rest of Canada and that the commissioner gain the ability to issue administrative monetary penalties for violations of PIPA.

“An administrative monetary penalty regime would make clear that the privacy rights of Albertans are meaningful, well protected and incentivize investments in information security on the front end.”

Other recommendations include developing the right to data portability and mobility, developing specific protections for children’s personal information, and creating requirements for de-identification and anonymization of personal information.

Article content

“Alberta needs a modernized private sector privacy law that aligns with leading global privacy laws,” McLeod said.

“Our goals include ensuring that there are no gaps in the protection of personal information in Alberta that may create unacceptable risks to Albertans.”

mblack@postmedia.com

You can also support our journalism by becoming a digital subscriber. Subscribers gain unlimited access to The Edmonton Journal, Edmonton Sun, National Post and 13 other Canadian news sites. Support us by subscribing today:The Edmonton Journal|The Edmonton Sun.

Article content