Canada's interest in open digital trade stems from the significant potential for growth and resilience in the face of global challenges, as evidenced during the COVID-19 pandemic. In 2020, Canada's digitally delivered services exports increased to CAD 39 billion, up from CAD 31 billion in 2019 (USD 29 and 23 billion respectively). Two out of three Canadian Dollars earned in service exports stem from digital delivery. Canada’s Digital Charter sets out human-centred principles for Canadian organisations to lead global innovation and embrace the benefits of the digital economy. But what do Canada’s domestic digital policies stand for?

The fourth DPA Digital Digest provides a concise overview of Canada's latest digital policy and enforcement developments in major policy areas and specific focal points:

• In data governance, Canada is deliberating amendments regarding data protection and cybersecurity, while enforcement targets large technology firms, their analytics services and facial recognition technology.
• In content, the government has proposed obligations regarding online news remuneration and online streaming content, while deliberating a new approach to online harms.
• Competition policy evolved regarding mergers in digital markets and may change concerning enforcement in digital markets, which are regularly investigated.
• Other focal points include public procurement blacklisting, artificial intelligence, cryptocurrencies and digital taxation.

Jump directly to the section that interests you most:

Discover the details of Canada’s approach below and stay informed on our dedicated page: https://digitalpolicyalert.org/countries/canada

Remain up-to-date on new and upcoming policy developments with our free notification service: https://digitalpolicyalert.org/subscription

Data governance

Data protection policy developments

Canada's data protection and cybersecurity regimes are based on the 2000 Personal Information Protection and Electronic Documents Act (PIPEDA).^[1] The Digital Charter Implementation Act (2022), re-introduced by the Canadian government in June 2022, includes the Consumer Privacy Protection Act. The Act aims to replace the PIPEDA, expanding requirements on entities collecting personal information for commercial purposes. For consent to be valid, the Act requires specific information on the purpose, ways and consequences of personal information collection, use or disclosure. The Act grants individuals the private right of action and the right to data mobility and disposal. Regarding cybersecurity, the Act requires entities to establish physical, organisational, and technological safeguards that are proportionate to the sensitivity, quantity, format, and storage of the information. For non-compliance, maximum fines are 5% of revenue or CAD 25 million (approx. USD 18.5 million). Actions brought under the Consumer Privacy Protection Act underlie the jurisdiction of a new specialised court that would be established by the Personal Information and Data Protection Tribunal Act.

Also in June 2022, the government introduced the Critical Cyber Systems Protection Act. The Act would create a national regulatory cybersecurity framework for institutions and systems imperative to national security. The Act outlines obligations for operators and designated cyber-threat response teams, including breach reporting, risk mitigation and third-party/supply chain risk evaluation. Furthermore, the Act empowers authorities (specifically, the “Governor in Council”) to create binding Cyber Security Directions with specific measures to eliminate or reduce cyber threats.

 

Enforcement developments

In February 2023, the data protection authorities of Canada, Alberta, British Columbia and Québec, announced a joint investigation into TikTok. The investigation assesses TikTok's acquisition of consent for the collection, utilisation and disclosure of personal information and practices for safeguarding minors' personal information.

 

Earlier in 2023, the Office of the Privacy Commissioner of Canada (OPC) closed an investigation into Home Depot for forwarding customer information to Meta Platforms (for the "Offline Conversions" tool) without consent. The OPC ruled that explicit opt-in consent was required and recommended Home Depot discontinue the use of the tool, which it did in October 2022.

 

In 2021, a joint investigation by the data protection authorities of Alberta, British Columbia and Québec ordered Clearview AI to cease offering its facial recognition services in Canada, stop collecting images from Canadian individuals and delete previously collected images and biometric facial arrays.

Also in 2021, the Federal Court of Canada ruled that PIPEDA applies to search engine results. The court dismissed Google’s claim that search engine results are out of scope because search services are not commercial. In addition, it denied the use of the journalism exception because Google is not a publisher, as it does not control the content of search results.

Content moderation

Content moderation developments

In February 2022, the government released responses to its consultation on the regulation of social media and to combat harmful online content. The proposal revives a statutory requirement for major platforms to make harmful content inaccessible in Canada. Harmful content includes terrorist and violent content, hate speech, child sexual exploitation as well as non-consensual sharing of intimate images. Major platforms would be obliged to proactively monitor and take down harmful content within 24 hours. In addition, platforms must report specific content types to law enforcement authorities and newly created regulatory bodies that are granted blocking powers.

In April 2022, the Minister of Canadian Heritage introduced the Online News Act. The Act aims to ensure “fair revenue sharing” between digital platforms and Canadian news outlets. The Act would promote commercial agreements between digital platforms and news outlets, which are enabled to bargain collectively. If the parties don’t reach voluntary agreements, the Act establishes a mandatory arbitration framework. The Canadian Radio-television and Telecommunications Commission (CRTC) would oversee negotiations and publish guidelines regarding news outlets’ eligibility for collective bargaining. As a reaction, Google reportedly tested blocking news content for some Canadian users temporarily in February 2023.

In February 2022, the government introduced the Online Streaming Act to adapt the Broadcasting Act to the digital age. The Act subjects “online undertakings” that transmit programs over the Internet (through social media or online streaming services) to the Broadcasting Act and the supervision of the CRTC. Undertakings must make the “greatest practicable” use of Canadian resources and contribute to the “creation, production and presentation” of Canadian content. Foreign undertakings would not have to be Canadian-owned.

Enforcement developments

There are no public, official sources on the Canadian government’s online content enforcement.

Competition

Competition policy developments

In February 2023, the government consulted on the review of the Canadian Competition Act regarding corrective measures and enforcement mechanisms in digital and data-driven markets. The government gathered information on the powers of the Competition Bureau and the effectiveness of remedies and private redress mechanisms, especially sector-specific mechanisms addressing anti-competitive actions in digital markets.

Already in 2022, the Canadian Competition Act’s merger rules were amended, empowering the Competition Bureau to consider expanded factors when clearing mergers. The factors include network effects, consumer choice and privacy. The Competition Bureau can also require notification of transactions below the pre-merger notification thresholds.

Enforcement developments

In March 2023, the Canadian Competition Bureau cleared the acquisition of Shaw Communications Inc. by Rogers Communications Inc., following a two-year investigation into the major acquisition in the telecommunications market.

The Bureau is currently investigating several major technology firms. In 2021, the Bureau opened an investigation into Google for alleged anti-competitive behaviour in online advertising. The investigation focuses on how Google’s platform YouTube sells advertisements and how Google’s dominance in the online advertising market impacts competition. In 2020, the Bureau opened an investigation into Amazon for abuse of dominance in its Amazon.ca platform. The investigation concerns conduct to 1) influence sellers to offer lower prices on the platform, 2) advantage sellers using its “Fulfilment By Amazon” service or advertising services and 3) influence consumers to purchase Amazon’s rather than competitors’ products. This follows a 2017 agreement with Amazon including a fine of CAD 1.1 million (approx. USD 808'000) for misleading consumers with unverified price comparisons.

Previous enforcement has targeted both large technology firms and smaller providers. In 2020, the Bureau reached an agreement with Facebook concerning misleading representations on the disclosure of personal information. Facebook paid a fine of CAD 9 million (approx. USD 6.6 million) and investigation costs of CAD 500'000 (approx. USD 367'000). In terms of behavioural remedies, Facebook agreed not to make further misleading representations on the control, access and disclosure of personal information. The Bureau previously focused on deceptive practices, such as hidden fees, by online ticketing firms. In 2021, it fined FlightHub CAD 5.8 million (approx. USD 4.2 million) and the two company directors CAD 400’000 (approx. USD 293'000) for misleading pricing, due to hidden mandatory fees added later in the purchasing process, and false online reviews. In previous years, the Bureau had sanctioned StubHub and Ticketmaster for similar pricing practices.

Further Canadian digital policy focal points

Public procurement blacklisting

In 2023, the Canadian government banned TikTok from government-issued mobile devices. The government justified the ban with TikTok’s unacceptable risk to privacy and security because of concerns regarding the legal regime concerning the information collected by mobile devices. Simultaneously, the app was banned from state devices in several regions including Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia and Quebéc.

In 2022, the Canadian government announced the prohibition of Huawei and ZTE products and services in Canadian telecommunications systems. The ban extended to the use of installed equipment, which had to be removed. The government justified the ban with concerns regarding the safety and security of Canadians and critical telecommunications infrastructure.

Artificial Intelligence

In 2022, the government introduced the Artificial Intelligence and Data Act, as part of the Digital Charter Implementation Act 2022. The Act introduces a risk-based approach to AI, setting specific rules for “high-impact AI systems” (defined by criteria developed in future regulation) and prohibiting reckless and malicious uses of AI through new criminal norms. The Act requires designers/developers of high-impact AI systems to identify and address individual and collective harms as well as systemic bias. Businesses that make high-impact systems available for use must ensure that users are aware of limitations.

In 2021, the government consulted on a Modern Copyright Framework for Artificial Intelligence and the Internet of Things. The consultation gathered information on the interplay between copyright, artificial intelligence and the internet of things and suggested three areas of reform: text/data mining, authorship/ownership of AI-generated works and AI copyright infringement and liability. In addition, the consultation presented limitations concerning the repair and interoperability of Internet of Things devices.

Cryptocurrencies

In 2023, the Canadian Securities Administrators (CSA) issued an order outlining investor protection commitments and registration requirements for crypto asset trading platforms. Platforms are expected to file "pre-registration undertakings" while applying for registration to operate in Canada. In December 2022, the CSA announced that it was strengthening its supervision of crypto trading platforms. All crypto trading firms operating in Canada are required to hold Canadian clients’ assets with an appropriate custodian and segregate client assets from their proprietary business. Furthermore, crypto trading platforms cannot offer margin or leverage for Canadian clients. Crypto assets are considered high-risk investments.

Taxation

In February 2022, the Canadian Ministry of Finance closed the public consultation on the Digital Services Tax Act. The tax of 3 per cent would apply to revenue generated through certain digital services that rely on Canadian users' participation, data, or content contributions, namely online marketplaces, online advertising, social media and user data. The tax would apply to enterprises that earn EUR 750 million (approx. USD 816.6 million) in income from all revenue streams globally and CAD 20 million (approx. USD 14.8 million) from in-scope revenue streams in Canada.

The tax was set for implementation on 1 January 2022 but was halted as the OECD/G20 Inclusive Framework was agreed upon by 137 nations in October 2021. In the 2023 budget, Canada declared its preference for an international solution and confirmed that it will not implement the tax until 1 January 2024 if the framework is adopted. If the framework fails, the tax will apply to revenues made since 1 January 2022.

Since July 2021, digital economy businesses including digital platforms must collect, account and register for the goods and services tax and the harmonized sales tax. The three types of businesses affected are 1) vendors who sell taxable digital products or services, including online music streaming, to Canadian consumers, 2) suppliers of qualifying goods in Canada and 3) providers of platform-based short-term accommodation.