Canada: Lawful Processing & Special Data

At the federal level, Bill C-36 as introduced would, if enacted, propose to treat de-identified information as personal information for certain purposes, a position that would narrow the current PIPEDA-era distinction between personal information and de-identified or anonymised data. This proposed treatment has direct relevance to any organisation currently relying on de-identification as a basis for processing data outside PIPEDA's personal-information perimeter, since Bill C-36's approach would, on its face, bring at least some de-identified datasets back within scope.

The practical effect of these two developments operating at different levels of government is that organisations handling biometric or de-identified data in Canada face a lawful-processing landscape that varies by province in its current operative state (Quebec's active necessity-and-proportionality enforcement under Law 25) while also facing a federal proposal (Bill C-36's de-identified-information treatment) that has not yet been enacted and would, if passed, apply nationally alongside or in place of Quebec's existing provincial regime.

Outlook

Whether the Commission d'acces a l'information's ongoing-supervision model for biometric processing becomes a template applied to future Quebec enforcement matters, and whether Bill C-36's de-identified-information provision survives committee review in its current form, are both open questions this cycle's material does not resolve.