Bill C-27 encompasses a wide range of provisions to enhance individual privacy protections. Key aspects that subject matter experts point out include:

• Expanded consent requirements: Individuals will have greater control over how their personal information is collected, used, and disclosed. Organizations must obtain explicit and meaningful consent from individuals before collecting or using their personal information.
• Increased transparency: Organizations will be required to provide individuals with transparent and easily accessible information about their personal information practices. This includes providing individuals with clear explanations of how their data is collected, used, and disclosed.
• Right to access and rectification: Individuals will have the right to access their personal information held by organizations and to request corrections if the information is inaccurate or incomplete.
• Right to erasure (disposal): Individuals will have the right to request that their personal information be erased in certain circumstances.
• Prohibition of unauthorized collection and use: Organizations will be prohibited from collecting or using personal information without authorization.
• New enforcement mechanisms: The Privacy Commissioner of Canada will be granted new powers to enforce the legislation, including imposing significant penalties for non-compliance.

Two additional key points that I believe are also important include:

PII disposal is defined in the current Bill C-27 as permanently and irreversibly deleting personal information or anonymizing it when requested by the data subject. This might seem trivial, but as far as I know, unrecoverable PII deletion is not addressed in any of the major international or U.S. State data privacy laws.

Most general counsels and Chief Privacy Officers assume that PII deletion/disposal from within a computer application infers an unrecoverable deletion. However, a standard Windows delete means deleted files are sent to the Recycle Bin. On Apple computers, deleted files are sent to the trash but not immediately erased.

In most operating systems, deleted files are only marked as such but still exist on the hard drive until other data overwrite them. This condition is what makes data recovery possible. Otherwise, when a data subject requests the deletion of their PII from a company’s systems, the “deleted” files can be quickly recovered until they are overwritten. However, all data privacy laws potentially intend that deleted PII is unrecoverable.

Another key provision in Bill C-27 is the private right of action. The bill grants individuals affected by a violation of the Consumer Privacy Protection Act (CPPA) the ability to bring an individual legal claim against a company when an individual suffers losses or injuries due to the organization’s violation of the CPPA. Many data privacy laws leave it up to an Attorney General or Privacy Commissioner to address a violation.

The CPPA provides Canada's Privacy Commissioner with broad order-making powers and the authority to impose significant monetary penalties on organizations. These penalties can go up to $10 million (CAD) or 3% of global revenue. The maximum penalty increases to $25 million or 5% of global revenue for serious non-compliance.

The private right of action is important for individuals to seek remediation when their privacy rights have been violated. It allows them to hold organizations directly accountable and seek compensation for any harm they’ve suffered due to privacy breaches. It also adds additional complexity and liability for non-compliant organizations.

The private right of action provision in Bill C-27 empowers individuals to take legal action against organizations that fail to protect their privacy rights, ensuring more vigorous enforcement and accountability in the digital age.

An interesting side note is that the U.S. federal ADPPA data privacy bill (not passed into law yet) also includes a private right of action.