Competition Bureau Flexes Muscles in the Privacy Sphere

Canada's Competition Bureau is signalling its intention to police privacy laws as breaches of the Competition Act. This shift in focus promises to raise the stakes for Canadian companies (and, potentially, other entities) that fail to live up to their privacy law disclosure obligations. Businesses operating in Canada should ensure robust privacy and data governance frameworks are properly implemented as stronger enforcement will almost inevitably form part of the anticipated Canadian privacy regime.

On February 11, 2020 the Bureau released its "strategic vision" for 2020-2024 titled "Competition in the digital age."^[1] The report speaks in general terms but raises two key themes: (1) leadership in the "digital economy" and (2) greater collaboration with the Bureau's "core international partners."

Privacy enforcement for the digital economy

A recent speech by the Bureau's Deputy Commissioner^[2] fleshes out the Bureau's plan to police the digital economy. Noting that "[d]ishonest price claims, suspicious consumer reviews, and dishonest information about data privacy rank high on the list of concerns," the Deputy Commissioner staked out a role for the Bureau in enforcing what are usually seen as matters of pure privacy law:

The issues of privacy and deceptive marketing practices intersect in the online marketplace. The Bureau aims to ensure truth in advertising by addressing misleading claims about consumer privacy. This is complementary with the mandate of the Office of the Privacy Commissioner, or the OPC, which is mandated to protect the privacy rights of Canadians. For instance, when firms make false or misleading statements about the type of data they collect, why they collect it, and how they will use, maintain and erase it, we will take action. The Bureau is ready to protect competition in the digital economy and put a stop to behaviours that harm consumers.

It will be interesting to see how the Bureau and the Office of the Privacy Commissioner (OPC) will work collaboratively (rather than competitively) in addressing these issues. The Bureau brings considerable regulatory firepower to the fight against companies misleading consumers (in online privacy policies, for example) about the extent to which they comply with privacy law obligations. The Bureau can seek administrative penalties against companies of up to $10 million for first offences, and up to $15 million for subsequent infractions.

The Bureau's inspiration likely comes from its American counterpart, the Federal Trade Commission (FTC).^[3] It is unclear, however, if a similar approach would work in Canada. The FTC draws its unique impact from its historical, structural and cultural strengths for privacy enforcement while Canada's privacy watchdog, the OPC is already mandated to enforce the two federal privacy laws that set out the rules for how federal government institutions and certain businesses must handle personal information. The FTC is a general-purpose consumer protection agency that allows it to sue almost any business under its broad investigatory and enforcement powers whereas in Canada the lines of authority are more clearly delineated.^[4] While this raises jurisdictional concerns among privacy and competition law practitioners, it must be borne in mind that the consultations to explore mutual interests between the two regulators have been ongoing for years. It appears that it is now only a matter of time that the Bureau would flex its muscle to enforce violations of privacy laws.

While some advocate strongly for the FTC's involvement in this space,^[5] the FTC has had its own skeptics—from inside the tent, no less. One of the FTC's own commissioners has recently stated that "[c]ompetition and privacy are often at odds" and that efforts to police privacy via antitrust law "will fail."^[6] Among other quandaries, the commissioner pointed out that tech companies reducing the extent of their consumer data gathering (in an effort to meet privacy law obligations) decrease the amount of data available for competitors in the digital market.^[7]

Notably, the Bureau's proposed reach extends beyond that of the OPC in some respects. Even as it assesses how it fits into a new era of holding businesses accountable to expectations of privacy, the Competition Bureau is being challenged to clarify whether it can police privacy obligations for organizations which have typically been treated as exempt from most existing privacy regulatory regimes: federal political parties.

Federal political parties have typically been considered exempt from federal privacy legislation such as the Privacy Act^[8] and PIPEDA. Consequently, political parties face fewer regulatory risks in the collection, use, and disclosure of personal information in the course of operation. Only BC, under its own privacy statute, currently actively regulates the privacy practices of political parties.

Many, including the Competition Bureau, have acknowledged ongoing investigations into the complaints, although details about the process and progress remain limited for the time being. The outcome of these investigations may serve as litmus tests for whether these agencies can take on the responsibility of protecting privacy and assist the Privacy Commissioners in this mandate. If the answer is affirmative, it can further give confidence for these agencies, particularly the Competition Bureau, to fulfill this role in the private sector as well.

A global role for the Bureau

In his January 2020 address, the Bureau's Deputy Commissioner further observed that

[t]he Bureau is ready to protect competition in the digital economy and put a stop to behaviours that harm consumers. This is a very big job though, and we certainly can't do it alone. Because, cross border problems require cross border solutions. On an enforcement level, the multinational nature of e-commerce lends itself to collaboration with our partners, both domestically and internationally. Our close relationships with partners such as the International Consumer Protection and Enforcement Network, or ICPEN, and the Organisation for Co-operation and Economic Development, or OECD, will help the Bureau to fulfill its mandate and deliver on its strategic priorities.^[9]

This nod toward greater global integration and collaboration follows a vector the Bureau has been following for some time. On July 18, 2019, the Bureau announced that the competition authorities of the G7 countries and the European Commission agreed on the principles of the common understanding highlighting opportunities and challenges raised by the digital economy and cooperation with their international counterparts. The Bureau also has cooperation instruments in place with 16 jurisdictions.

This approach shows the changing narrative in not only the global privacy regime but also the seismic shifts anticipated in Canada's approach toward regulation of the mutable digital marketplace

Conclusion

The Bureau is about to enter an unchartered territory already occupied by the OPC. If the Bureau and other regulatory bodies—at home and abroad—can take on the mantle of enforcing privacy obligations in concert with privacy regulator, it will mean Canada will enter into a new era of privacy enforcement, with greater incentives and sanctions to aid in the protection of personal information.