OTTAWA — The Liberal government’s latest attempt at updating private-sector privacy rules must be significantly revised to better protect people online, according to Jim Balsillie, one of the country’s most vocal innovation-economy executives. Here’s what you need to know.

The backstory: In June, Innovation Minister François-Philippe Champagne introduced Bill C-27, which would replace Canada’s two-decade-old personal information law with the new Consumer Privacy Protection Act (CPPA). An earlier version had failed to pass through Parliament. The CPPA includes plain-language consent and data portability requirements, but lets organizations use people’s data without express permission for what they consider routine purposes. 

The asks: On Thursday, the Centre for Digital Rights (CDR) will publish 41 recommended changes to the bill. Balsillie, the former co-CEO of Research In Motion (now BlackBerry), founded the non-profit in May 2018. It’s since launched a series of legal and regulatory complaints about political parties’ data collection practices. 

“It’s historic legislation, and data governance is the most important public policy issue of our time,” Balsillie said in an interview with The Logic. CDR says its suggested changes are based on the laws enacted by other jurisdictions like the EU and California, and consultations with Canadian privacy experts.

Here’s some of what the group is calling for:

• Recognize privacy as a human right in law: The former and new privacy commissioner have said similar. Bill C-27 includes a preamble that says protecting people’s privacy is “essential to individual autonomy and dignity and to the full enjoyment of fundamental rights and freedoms.” But Balsillie and the CDR say that’s not enough.

• Include political parties in the legislation. Federal parties have long relied on voter-information databases to inform door-knocking and other campaign activities. But political parties fall in a legal void between the private- and public-sector privacy laws. 

• Prioritize users’ interests over those of businesses: The CPPA currently lets organizations balance their own potential commercial gains against possible negative outcomes for the people involved, according to the CDR. The law should “put it into a very narrow box, where you get very specific consents [and] show you’re not causing harm,” said Balsillie.

• Require privacy impact assessments: Federal government departments launching new or revised programs that involve people’s personal information are typically required to conduct these. The CDR wants them extended to the private sector, “particularly where invasive technologies or business models are being applied.” It also suggests them when companies plan to move data across borders. A push by the privacy commissioner for consent for such international information flows foundered following industry objections.

• Scrap the robot law: Bill C-27 sets up a new Artificial Intelligence and Data Act (AIDA), designed to limit use of “high-impact” systems, a term it doesn’t define but could include ones that produce biased decisions or put people’s safety at risk.  Privacy experts expressed surprise at its inclusion, noting the government hadn’t conducted prior consultation and that the legislation leaves much of the detail of when and how to future regulations. “It just comes out of the blue,” Balsillie said, noting that by contrast “the EU is doing very specific AI regulations.” The CDR says AIDA is too narrow, and doesn’t account for all the ways organizations use algorithms—on social media platforms, say.

What comes next: Bill C-27 is at second reading in the House of Commons. Eventually, it will head to committee, where legislators can propose changes. Balsillie said he’s had extensive discussions with MPs from all three leading federal parties, and seen “tremendous appetite for amendments.”

Correction: The Centre for Digital Rights report will be released on Thursday, not Tuesday. The story has been updated.