1 Canada's Privacy Commissioner is seeking public feedback on draft consent guidance In May 2016, the Canadian Privacy Commissioner launched a public consultation on the issue of consent under the federal Personal Information and Electronic Documents Act ("PIPEDA").On September 21, 2017, the Commissioner published its Report on Consent in its 2016-17 Annual Report to the Canadian Parliament. The report sets out the Commissioner's recommendations on addressing challenges posed to the current consent model. At a high-level, the Commissioner recommends that: consent be made more meaningful; alternatives to consent be considered; and governance be improved. Detailed proposed action steps and recommendations are set out in the report, and the Commissioner is already moving forward with some of the action steps, including the release of two draft guidance documents. The first draft guidance addresses the Commissioner's views on obtaining meaningful consent in an online environment (the "Online Meaningful Consent Guidance"), and sets out four key considerations - which are: 1. organizations are required to obtain individuals' meaningful consent for the collection, use and disclosure of personal information 2. organizations should be fully transparent about their privacy practices 3. communicating privacy practices is not a one-size-fits-all proposition 4. organizations should recognize and adapt to special considerations in managing the personal information of children and youth. In addition, the Online Meaningful Consent Guidance explains how "just in time" notices, layered notices, icons, and other creative and interactive methods can enhance online consent, and it highlights some of the challenges posed by mobile technologies and user expectations. The second draft guidance addresses areas in which the Commissioner considers it inappropriate to collect, use or disclose personal information even where consent is obtained (the "No-Go Guidance"). These are often referred to as "no-go zones". The No-Go Guidance summarizes how Canadian courts have interpreted subsection 5(3) of PIPEDA, which states that organizations can only collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances, and the guiding principles and evaluative framework for subsection 5(3). In the Commissioner's opinion, the following six areas are current no-go zones: 1. collection, use or disclosure that is otherwise unlawful 2. profiling or categorization that leads to unfair, unethical or discriminatory treatment 2 3. collection, use or disclosure for purposes that are known or likely to cause significant harm to the individual 4. publishing personal information with the intended purpose of charging individuals for its removal 5. requiring passwords to social media accounts for the purpose of employee screening 6. surveillance by an organization through audio or video functionality of the individual's own device. The Commissioner makes it clear that no-go zones are fluid, and additional areas may be added to the Commissioner's list. The Commissioner is accepting feedback on the draft Online Meaningful Consent Guidance and the No-Go Guidance until November 24, 2017. It is anticipated that the draft guidance will be finalised in 2018. For more information, please contact: Theo Ling or Dean Dolan.