Bill S-4 · 41th Parliament · Stephen Harper
Digital Privacy Act
An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act
Government bill. Became law.
- IntroducedApril 7, 2014
- Debated in principleMay 7, 2014
- Studied by a committeeDone
- Passed its first chamberJune 15, 2014
- Passed the second chamberJune 18, 2015
- Became lawJune 17, 2015
Leading supporters
Ranked by the part each played: who is responsible for the bill, who carried it, and who spoke for it most.
- Stephen HarperPrime Minister
Who carries this bill
Arrows run from the person responsible to those who answer to them on this bill. The critic leads the Senate’s scrutiny and answers to no one on it.
What it set out to do
On 8 April 2014, the Leader of the Government in the Senate introduced Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act (Digital Privacy Act) in the Senate and it was given first reading. Bill S-4 amends the Personal Information Protection and Electronic Documents Act to, among other things (a) specify the elements of valid consent for the collection, use or disclosure of personal information; (b) permit the disclosure of personal information without the knowledge or consent of an individual for the purposes of (i) identifying an injured, ill or deceased individual and communicating with their next of kin, (ii) preventing, detecting or suppressing fraud, or (iii) protecting victims of financial abuse; (c) permit organizations, for certain purposes, to collect, use and disclose, without the knowledge or consent of an individual, personal information (i) contained in witness statements related to insurance claims, or (ii) produced by the individual in the course of their employment, business or profession; (d) permit organizations, for certain purposes, to use and disclose, without the know…
Summary by the Library of Parliament.
Where members stand
Votes and debate for this bill have not been read yet.
How it changed on the way
71% of the text as introduced was changed or removed by the time it became law (7,749 words introduced, 5,735 passed).
substantial changeintent mostly kept
The bill kept its core amendments to PIPEDA on consent, disclosures without consent, and business transactions but was expanded with new breach notification rules and refined wording during passage. Over 70% of the introduced text was altered or replaced before royal assent in June 2015.
- Updated parliamentary session reference and added royal assent details in the final statute.
Before: “Second Session, Forty-first Parliament, 62-63 Elizabeth II, 2013-2014”
After: “Second Session, Forty-first Parliament, 62-63-64 Elizabeth II, 2013-2014-2015”
How precisely it is written
mixedChallenging the law: ModerateDisputing a charge: Moderate
The bill mixes concrete definitions and lists with repeated subjective tests such as 'reasonable in the circumstances' and 'real risk of significant harm'. This leaves room for argument over when duties to report or notify are triggered.
Open to argument
“if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to”
Uses a combined reasonableness and risk standard that requires case-by-case judgment rather than an objective threshold.“the organization has reasonable grounds to believe that the individual has been, is or may be the victim of financial abuse”
Relies on the organization's own assessment of likelihood and harm without fixed criteria.“made to another organization and is reasonable for the purposes of detecting or suppressing fraud or of preventing fraud that is likely to be committed”
Employs open-ended reasonableness and 'likely' language that invites disputes over scope.
Clear-cut
“"personal information" means information about an identifiable individual.”
Supplies a short, closed definition that can be applied directly.
Discretion. The Privacy Commissioner may enter compliance agreements containing any terms the Commissioner considers necessary and may disclose breach reports to government institutions on reasonable grounds.
Challenging the law itself. The repeated 'real risk' and 'reasonable in the circumstances' standards could be attacked under the Charter doctrines of vagueness or overbreadth, particularly if liberty or security interests are engaged.
Disputing a charge under it. An organization facing prosecution or a compliance order can readily argue that its assessment of risk or reasonableness differed from the Commissioner's without clear statutory benchmarks to resolve the disagreement.
Read by a language model from the royal assent text; every quoted phrase appears in the bill. A reading of the drafting, not legal advice.
Did it work?
no evaluation found
Who lobbied on it
No lobbying registration naming this bill is loaded.
Stages and dates from LEGISinfo.