Text and Context: Making Sense of Canada's New Personal Information Protection Legislation

Abstract

The normative provisions relating to privacy in Canada's new Personal Information Protection and Electronic Documents Act are as general as one might expect, given their origin in a voluntary, multi-sectoral model Code. The generality which is the virtue of a model code, however, may well be a vice for mandatory and enforceable legislation. This paper provides a critique of the provisions of the legislation that deal with the key concept of consent. The author argues that the problems with the legislation will make it particularly difficult for businesses and consumers alike to determine what privacy protections are required across a range of different circumstances. The author then explores a variety of "tools" which may be of use in determining what measures are required in different circumstances in order to comply with the legislation. These include the office of the Privacy Commissioner, past practice, other legislation, sectoral codes, privacy seal programs, P3P and privacy statement generators.