ABSTRACT
The Canadian approach to de-identification outlined in Canada’s proposed Consumer Privacy Protection Act Bill C-27 (‘Bill C-27’) fails to satisfy the heightened GDPR requirements of pseudonymisation and is likely insufficient to meet the requirements of data protection by design and by default under EU law. Embracing a low de-identification standard, rather than heightened obligations for data protection by design and by default like statutory pseudonymisation, could position Bill C-27 unfavourably for an adequacy determination due to obligations under EU law requiring technical ‘before-the-fact’ protection of personal data. Given the interconnected nature of international data flows, and the exposure represented by sub-processor and cloud processing, Canada should consider following South Korea (the Republic of Korea) in adopting strong requirements for statutory pseudonymisation that helped secure EU adequacy determination.
Feys, Magali, Is Canada’s Proposed Consumer Privacy Protection Act Too High Risk Compared to EU Data Protection Law? (August 22, 2022).
Leave a Reply