In a significant shift within Canada’s regulatory landscape, the government has proposed the creation of the Digital Safety and Data Protection Commission, a body intended to oversee the complex intersection of online safety and data privacy. This ambitious initiative, introduced in the latest legislative reforms, aims to tackle the myriad challenges posed by digital platforms, including the protection of children’s data and the regulation of artificial intelligence. However, concerns are mounting that the commission may become overwhelmed by its expansive mandate before it even becomes operational.
The Expanding Role of the Commission
Initially proposed as part of a bill aimed at regulating social media, the Digital Safety Commission appeared to offer a flexible approach to the evolving challenges of overseeing large digital platforms. Yet, in a matter of days, new obligations and powers have been added, prompting a rebranding to the Digital Safety and Data Protection Commission of Canada. This shift raises questions about the feasibility of such a comprehensive body managing the extensive responsibilities now on its plate.
Michael Walsh, a privacy lawyer at Gowling WLG, remarked on the unprecedented nature of this regulatory model, noting, “This kind of model for a digital regulator of this size with such a large footprint is pretty unprecedented.” The commission’s dual role in overseeing both online safety and private-sector privacy is particularly striking; traditionally, these functions have been managed separately, with the latter falling under the jurisdiction of the Privacy Commissioner.
A Complex Regulatory Landscape
The breadth of the commission’s responsibilities encompasses a wide array of issues, including the collection and misuse of personal data, data sovereignty, competition policy, and the implications of artificial intelligence. This combination of mandates presents a monumental challenge for any regulatory body. Previous attempts by the Liberal government, under Justin Trudeau, to update privacy legislation and address online harms have struggled to find a sustainable solution.
Prime Minister Mark Carney’s administration had linked AI adoption strategies to privacy protections, yet the specifics of regulatory implementation remained ambiguous. For instance, while Evan Solomon, the Minister of Artificial Intelligence, has indicated that the new commission will provide guidance on surveillance pricing—where companies utilise personal data to determine pricing strategies—many questions linger about the commission’s broader role and effectiveness.
Michael Geist, Canada Research Chair in internet and e-commerce law at the University of Ottawa, encapsulated the complexity of the commission’s structure: “There’s a regulatory piece, there is an advocacy piece, there is a policy-making piece, there is an ombuds piece for potential complaints, and this has brought all of that together.” The potential for the commission to function simultaneously as judge, jury, advocate, and investigator could create significant challenges in its operations.
The Bureaucratic Challenge Ahead
As the legislation progresses through Parliament, the practicality of establishing this super-regulator raises further concerns. The task of creating a new bureaucratic entity with such broad jurisdiction is formidable. Analysts estimate that hundreds of new positions will need to be filled, and the experience of other regulatory bodies, such as the Canadian Transportation Agency, suggests that managing complaints could lead to substantial backlogs.
Moreover, the dismantling of the existing functions of the Privacy Commissioner and their integration into the new commission poses its own set of challenges. The establishment of uniform standards for compliance and enforcement will be critical but time-consuming, potentially taking two years or more before the commission is fully operational.
While Canadian companies are already accustomed to privacy impact assessments and management plans, the uncertainty surrounding how the new body will interpret these regulations leaves businesses in a state of apprehension. As they navigate this shifting regulatory environment, organisations may find themselves grappling with an unclear set of rules over the next few years.
Why it Matters
The creation of the Digital Safety and Data Protection Commission represents a pivotal moment in Canada’s approach to digital regulation and privacy protection. With an expansive mandate that combines online safety and data privacy, this commission could set a precedent for similar regulatory frameworks globally. However, the potential for bureaucratic overload raises serious questions about its efficacy and ability to respond to the rapid changes within the digital landscape. As Canada embarks on this ambitious endeavour, the success of the commission will ultimately depend on its capacity to harmonise its numerous responsibilities without becoming bogged down in its own complexity.
