Canada's New Consumer Privacy Protection Act (CPPA)

Canada's New Consumer Privacy Protection Act (CPCPA) is a set of rules that apply to all Canadian businesses that collect, use and disclose personal information about Canadians. The law sets out how organizations must handle people's personal information and how they must respond to privacy concerns. The CPPA came into force on January 1, 2022.

The CPPA replaces the Personal Information Protection and Electronic Documents Act (PIPEDA) which was enacted in 2001, but has not been updated since then. The new law brings PIPEDA up to date with modern technology such as big data and artificial intelligence algorithms. It also includes changes to reflect new types of business models such as online marketplaces and social media platforms.

The CPPA makes it easier for consumers to control their own personal information by giving them more control over how it is used by companies and organizations that collect, use or disclose it. It also expands the circumstances in which consumers can sue companies for violations of privacy rights under the Act.

Under the CPPA, organizations must:

• make sure that individuals are informed about how their personal information will be collected, used, and disclosed;
• ensure that the individual has consented before any personal information is collected;
• ensure that personal information is accurate and up-to-date before using it;
• protect personal information by using reasonable security safeguards against loss or theft, unauthorized access or disclosure; and
• provide individuals with access to their personal information upon request.