The day after the government introduced Bill C-32, I spoke at the GRAND Annual Conference, a federal NCE on Graphics, Animation and New Media.  While the full talk discussed recent attempts at copyright reform, I've pulled the discussion on C-32 into its own video.  The 16 minute talk - a combination of slides and audio (recorded off an iPhone so excuse the quality) - is available online and posted below.

IP Watch reports on plans by China and India to raise concerns about ACTA at the World Trade Organization this week.

Three major U.S. technology industry groups have jointly spoken out against ACTA.  The Consumer Electronics Association, TechAmerica and the Computer & Communications Industry Association plan to oppose the current ACTA draft.

The Canadian Press reports that Spain's ambassador to Canada has identified intellectual property rights as a key stumbling block to a Canada - EU Trade Agreement.

The CBC reports that Quebec's government broke the law by buying software from Microsoft without considering offers from other vendors, the province's Superior Court has ruled.

It did not attract much media attention other than a few tweets, but perhaps the most noteworthy aspect of the Ministerial news conference on Wednesday launching Bill C-32 was the comments from Canadian Heritage Minister James Moore on the possibility on bringing a three-strikes and you're out (or "graduated response") system to Canada.  While some have encouraged the government to move in that direction in recent months, Moore slammed the door shut on that possibility.  According to Moore:

One of the proposals that was suggested was the idea that Canada would have a three strikes rule, which is what they have in France.  We don’t agree with that. I don’t think a three strikes rule is in the best interests of consumers. Which is what, consumers would receive three notices or three allegations of impropriety and then their internet would be cut off.  It would be devastating for individual Canadians, bad for consumers, because now, access to the internet is part of our everyday lives, not just for movies and for songs, but for doing banking, for taking care of your mortgage, for communicating with your kids, for communicating with family across the country. This is an essential part of our economy, so we disagreed with the idea of a three strikes rule.

This is good news, particularly given comments this week from Bloc MP Carole Lavallée, who seemingly thinks three strikes is too generous.  She urged the government to adopt a two strikes and you're out policy.

Update: I received an email from Ms. Lavallée this afternoon indicating that the Canoe story did not fully capture her views.  She says that three strikes is an option that should be discussed, but that she did not put it forward as a firm solution.

The Wire Report reports that Liberal MP Marc Garneau believes that C-32's digital lock provisions is the most significant issue raised by bill.  Garneau says "the question of how to proceed on legal protection for digital rights management remains the most significant one. The provision has to balance the interests of industry stakeholders, who want the locks protected, and the interests of consumers." Garneau indicated that there is a way to balance the interests and that the party would make some proposals on the issue. Meanwhile, Canadian Heritage Minister James Moore indicated a willingness to entertain reform proposals.  When asked specifically about reforms to the digital lock provisions, Moore said that parties should bring forward specific language.

Thanks to the hard work of my research assistant Keith Rose, posted below is comparison chart of the two Conservative copyright bills - this week's C-32 vs. the 2008 C-61 bill.  An annotated version can be accessed here.  A straight comparison is available here and embedded below. 

The reactions to C-32 rolled in yesterday with many groups supporting much of the balance struck by the bill but expressing concern with the digital lock provisions.  That perspective was consistent across the spectrum - businesses, education groups, librarians, and some creator groups all said virtually the same thing:

• Business Coalition for Balanced Copyright: balanced, common sense approach but "some parts of the legislation unfairly restrict consumer freedom and need to be revised before being passed by Parliament such as the inability to circumvent digital locks for private use."
• Retail Council of Canada: encouraged by bill but "some parts of the legislation unfairly restrict consumer freedom and choice and need to be revised before being passed by Parliament."
• AUCC: Welcomes copyright bill but is "concerned about the overly strict prohibition against circumventing the technical measures"
• Canadian Bookseller Association: “would like to see the government go even further in the area of access, by allowing the public - particularly students and educators - to circumvent digital locks on material sought for educational and strictly non-commercial purposes.”
• Canadian Library Association: passing grade but "disappointed that longstanding rights, the heart of copyright's balance, as well as the new rights, are all tempered by the over-reach of digital locks"

I attended yesterday's C-32 media lockup on behalf of the Toronto Star, who asked for a quick analysis piece of the bill.  My column is posted below:

Copyright has long been viewed as one of the government's most difficult and least rewarding policy issues. It attracts passionate views from a wide range of stakeholders, including creators, consumers, businesses, and educators and is the source of significant political pressure from the United States.  Opinions are so polarized that legislative reform is seemingly always the last resort that only comes after months of delays.

The latest chapter in the Canadian copyright saga unfolded yesterday as Industry Minister Tony Clement and Canadian Heritage James Moore tabled copyright reform legislation billed as providing both balance and a much-needed modernization of the law.

The bill will require careful study (suggestions that a quick set of summer hearings will provide an effective review should be summarily rejected) but the initial analysis is that there were some serious efforts to find compromise positions on many thorny copyright issues.  


Unfortunately, the legal protection for digital locks - unquestionably the biggest and most controversial digital copyright issue - is the one area where there is no compromise.  Despite a national copyright consultation that soundly rejected inflexible protections for digital locks on CDs, DVDs, e-books, and other devices, the government has caved to U.S. pressure and brought back rules that mirror those found in the United States.  These rules limit more than just copying as they can also block Canadian consumers from even using products they have purchased.

Bill C-32, which ironically carries the same number as the last time Canada underwent major copyright reforms in 1997, features three types of provisions: sector-specific reforms, compromise provisions, and the no-compromise digital lock rules.

The sector-specific reforms are designed to address a single constituency or stakeholder concern. These reforms include something for almost everyone: new rights for performers and photographers, a new exception for Canadian broadcasters, new liability for BitTorrent search services, as well as the legalization of common consumer activities such as recording television shows and transferring songs from a CD to an iPod.  In fact, there is even a “YouTube” user-generated content remix exception that grants Canadians the right to create remixed work for non-commercial purposes under certain circumstances.

There are a number of areas where the government has worked toward a genuine compromise.  This includes reform to Canada's fair dealing provision, which establishes when copyrighted works may be used without permission.  

The government rejected both pleas for no changes as well as arguments for a flexible fair dealing that would have opened the door to courts adding exceptions to the current fair dealing categories of research, private study, news reporting, criticism, and review.  Instead, it identified some specific new exceptions that assist creators (parody and satire), educators (education exception, education Internet exception), and consumers (time shifting, format shifting, backup copies).

The Internet provider liability similarly represent a compromise, as the government is sticking with a "notice-and-notice" system that requires providers to forward allegations of infringement to subscribers.  The system is costly for the providers, but has proven successful in discouraging infringement.  

It also compromised on the statutory damages rules that create the risk of multi-million dollar liability for cases of non-commercial infringement.  The new rules reduce non-commercial liability to a range of $100 to $5,000, which is not insignificant but well below the $20,000 per infringement cap currently found in the law.

All these attempts at balance should be welcomed, yet they are undermined by the no-compromise position on digital locks.

The foundational principle of the new bill is that anytime a digital lock is used, it trumps virtually all other rights. This means that both the existing fair dealing rights and Bill C-32's new rights all cease to function effectively so long as the rights holder places a digital lock on their content or device.  Moreover, the digital lock approach is not limited to fair dealing - library provisions include a requirement for digital copies to self-destruct within five days and distance learning teaching provisions require the destruction of course materials 30 days after the course concludes.

The government could have introduced a compromise provision that would have allowed for compliance with international treaties, protection for digital locks and the preservation of the copyright balance. In failing to strike that balance, the government has introduced a flawed, but potentially fixable bill.

Given the public interest in copyright, it should come as little surprise to find intense media coverage of the introduction of the new copyright bill.  While the government's emphasis was on balance, it is interesting to note that much of the discussion in the media focused on the impact of the digital lock provisions.  Coverage includes:

• CBC - Copyright bill would ban breaking digital locks
• Reuters - Copyright bill bars abuse of digital locks
• Bloomberg - Canada Introduces Legislation to Amend Copyright Laws
• CP - Sweeping new copyright bill sets $100-$5,000 penalty for illegal copies
• CTV - Tories propose far-reaching changes to Copyright Act
• Toronto Star - Copyright bill to enshrine digital locks, user rights
• QMI - Bill protects copyright owners
• Montreal Gazette - Copyright bill makes it easier to go after illegal file-sharing
• Globe and Mail - Tory bill cracks down on copyright pirates

While there are critics of C-32, everyone should be willing to give props to Industry Minister Tony Clement for his tweeting on the bill.  Soon after the usual press conference, Clement began responding directly to public tweets asking questions about the bill.  He thanked the public for positive and negative feedback and answered questions on unlocking cellphones, format shifting CDs, copying DVDs, and statutory damages. This form of direct engagement with the public on government policy is something worth noting as it sets a benchmark for others to follow.

Reaction from both the Liberals and NDP focus on C-32 digital lock provisions.  Liberal critic Marc Garneau told CBC.ca that the bill seemed to be missing an exception that would allow people to break digital locks if it was for private, non-commercial use.  Meanwhile, the NDP's Charlie Angus argued "the only rights you will get under this bill are those that U.S.-based entertainment concerns decide you get. If the technological protections override those rights, then you have no rights."  Both MPs suggested that fast tracking the bill through summer hearings is not the right approach.

The government is using balancedcopyright.gc.ca as the domain name for its site devoted to Bill C-32.  Someone forgot to register the actual balancedcopyright.ca domain, however, which was quickly grabbed by the Pirate Party of Canada, which is now a registered political party.

This afternoon, the government introduced the Copyright Modernization Act (or Bill C-32), the long-awaited copyright reform bill [the bill is not yet online, but I attended the media lockup in Montreal]. It is nearly two years since C-61 was introduced and nearly a year since the national copyright consultation, yet discouragingly some things have not changed. As I reported several weeks ago, Canadian Heritage Minister James Moore won the internal fight over Industry Minister Tony Clement for a repeat of C-61's digital lock provisions and against a flexible fair dealing approach and today's bill reflects those policy victories. 

However, over the past month, Clement made steady in-roads in trying to restore some balance in the bill and achieved some wins. The bill contains some important extensions of fair dealing, including new exceptions for parody, satire, and (most notably) education.  It also contains more sensible time shifting and format shifting provisions that still feature restrictions (they do not apply where there is a digital lock) but are more technology neutral than the C-61 model.  There is also a "YouTube exception" that grants Canadians the right to create remixed user generated content for non-commercial purposes under certain circumstances. While still not as good as a flexible fair dealing provision, the compromise is a pretty good one.  Throw in notice-and-notice for Internet providers, backup copying, and some important changes to the statutory damages regime for non-commercial infringement and there are some provisions worth fighting to keep.

Yet all the attempts at balance come with a giant caveat that has huge implications for millions of Canadians.  The foundational principle of the new bill remains that anytime a digital lock is used - whether on books, movies, music, or electronic devices - the lock trumps virtually all other rights.  In other words, in the battle between two sets of property rights - those of the intellectual property rights holder and those of the consumer who has purchased the tangible or intangible property - the IP rights holder always wins.  This represents market intervention for a particular business model by a government supposedly committed to the free market and it means that the existing fair dealing rights (including research, private study, news reporting, criticism, and review) and the proposed new rights (parody, satire, education, time shifting, format shifting, backup copies) all cease to function effectively so long as the rights holder places a digital lock on their content or device.  Moreover, the digital lock approach is not limited to fair dealing - library provisions again include a requirement for digital copies to self-destruct within five days and distance learning teaching provisions require the destruction of materials 30 days after the course concludes. 

The digital lock provisions are by far the biggest flaw in the bill, rules that some will argue renders it beyond repair.  I disagree. The flaw must be fixed, but there is much to support within the proposal. There will undoubtedly be attacks on the fair dealing reforms and pressure to repeal them, along with the U.S. and the copyright lobby demanding that their digital lock provisions be left untouched.  If Canadians stay quiet, both are distinct possibilities.  If they speak out, perhaps the bill can be fixed.  I'll post an update of my 30 things you can do shortly.  In the meantime, I'm relaunching Speak Out on Copyright to focus on this bill and encouraging Canadians to join the Fair Copyright for Canada Facebook group (to get active) and the Fair Copyright for Canada Facebook Page (to stay updated).


What's in the Copyright Modernization Act?

This is a complicated bill that will require detailed study (and envisions a mandatory review of Copyright Act every five years), but it boils down to three groups of provisions: sector-specific rules, compromise provisions, and the no compromise digital lock provisions. 

1.   Sector-specific Rules

Bill C-32 contains many provisions that are designed to address a single constituency or stakeholder concern.  I'll post more on many of these in the coming days, but immediate sector-specific changes worth highlighting include:

• new performers rights as demanded by ACTRA (and as needed for WIPO Internet treaty implementation)
• new photographers rights as long demanded by photographer groups
• new exception that addresses potential concerns from companies like Research in Motion for temporary copies for technological processes
  
• new BitTorrent provision which establishes infringement for providing services via the Internet that a person knows or should have known is designed primarily to enable acts of copyright infringement
  
• new ephemeral exception as lobbied for by Canadian broadcasters
• new library provisions to allow for digital distribution (but subject to digital locks and destroying the copies after five days)
• new distance learning teaching exceptions that encompass podcasts (but subject to digital locks and destroying lessons within 30 days of conclusion of the course)
• a return of the Internet exception for education
  
• new "YouTube" remix exception for user generated content that permits non-commercial use of works under certain circumstances
  
• new technology-neutral format and time shifting provisions legalizing common consumer activities such as recording television shows and shifting CDs to iPods (but still subject to digital locks)
• new backup copy provision (subject to digital locks)
• expansion of the exception for the visually impaired
  

The sum total of these exceptions make for a more complicated Copyright Act, but also provide something for just about every stakeholder group.

2.   Compromise Provisions

Copyright reform invariably involves compromise and several tough issues were clearly resolved with an attempt to balance interests through compromise provisions.  Three areas in particular are worthy of discussion: fair dealing, intermediary liability, and statutory damages.

Fair Dealing.  As reported earlier, the government rejected a made-in-Canada flexible fair dealing provision as Moore emerged as the anti-exception Minister.  Despite that initial starting point, there are many exceptions that address creators (parody and satire), education (education exception, education Internet exception), consumers (time shifting, format shifting, backup copies), and user generated content (USG exception).  While this leaves innovative businesses without the benefit of flexible fair dealing and Canada still short of the U.S. fair use provision, it is a pretty good compromise.

Intermediary Liability.  For the third consecutive bill, the government has opted for a notice-and-notice system for Internet providers.  The system is costly for Internet providers, but has proven successful in discouraging infringement.  It is also far more balanced than the U.S.-backed notice-and-takedown approach or the incredibly disproportionate three-strikes model that would result in terminating subscriber access.

Statutory Damages.  Many groups called for changes to the current statutory damages system that treats large-scale counterfeiting in the same manner as non-commercial cases.  The new rules reduce statutory damages for non-commercial cases to as low as $100 along with a maximum of $5000.  That is not insignificant, but it is well below the current $20,000 maximum.  In other words, there are still tough potential damages but the law finally distinguishes between commercial and non-commercial infringement.  Note that the bill also provides the prospect of targeting sites that facilitate infringement with aggressive new penalties.

3.   No Compromise Provisions

The one area where there is no compromise are the digital lock provisions. The prioritization of digital locks is the choice of the U.S. DMCA and is now the choice of the Canadian DCMA.  In fact, the Canadian digital lock provisions are arguably worse than those found in the U.S., with fewer exceptions and greater difficulty to amend the rules.  The Canadian DCMA provisions are virtually identical to the U.S. - a handful of hard-to-use exceptions, a ban on the distribution and marketing of devices (ie. software) that can be used to circumvent, and a presumption that any circumvention is an infringement.  The only significant difference between this bill and C-61 on digital locks is the inclusion of an exception for unlocking cell phones.

It is important to emphasize that this need not be the Canadian choice.  Canada could comply with the WIPO Internet treaties (which serve as the impetus for these provisions), provide legal protection for digital locks, and still preserve the copyright balance.  Doing so would simply require a provision confirming that circumvention of a digital lock is not prohibited when undertaken for lawful purposes.  Similar language can be found in other countries' digital lock legislation and - as the top issue raised during last summer's copyright consultation - should have made it into this bill.  Clement has indicated that the government is open to amendments and the opposition parties should place reform of the digital lock provisions at the very top of the list.

I will be posting much more in the days and weeks ahead on the bill, but the initial reaction depends on whether you are a glass half full or glass half empty person.  For the glass half-full, the compromise positions on fair dealing, the new exceptions, and statutory damages are not bad - not perfect - but better than C-61.  For the glass half-empty, the digital lock provisions are almost identical to C-61 and stand as among the most anti-consumer copyright provisions in Canadian history.  Not only are they worse than the U.S. DMCA, but they undermine much of the positive change found in the rest of the bill. In the days and weeks ahead, Canadians must speak out to ensure that the compromise positions found in C-32 remain intact and that the digital lock provisions move from the no-compromise category to the compromise one.

David Akin has pointed to a new paper from Blayne Haggart, a doctoral student at Carleton who is focusing on copyright policy in Canada, the U.S., and Mexico.  The paper, being presented this week in Montreal, includes some interesting analysis of digital copyright reforms in each country.  Given today's introduction of the copyright reform bill, of particular significance are comments Haggart obtained from Michele Austin, who served as Maxime Bernier's chief of staff when he was Industry Minister. 

According to Austin, the decision to introduce U.S.-style DMCA rules in Canada in 2007 was strictly a political decision, the result of pressure from the Prime Minister's Office desire to meet U.S. demands.  She states "the Prime Minister's Office's position was, move quickly, satisfy the United States." When Bernier and then-Canadian Heritage Minister Bev Oda protested, the PMO replied "we don't care what you do, as long as the U.S. is satisfied."

This mandate will not come as a huge surprise to anyone who has followed the issue, but it still shocks to see it presented in such stark terms.  Given the strong public opposition to the anti-circumvention provisions in C-61, the thousands of Canadians who spoke out against the U.S. approach during the copyright consultation, and even Industry Minister Tony Clement's reported support for a more flexible approach, it would appear that the PMO's decision to side with Canadian Heritage Minister James Moore in requiring strict anti-circumvention rules reflects a long-term decision to prioritize U.S. interests on copyright ahead of the national interest.  The decision is particularly discouraging since it is unnecessary - a compromise could be struck that provides legal protection for digital locks, is WIPO compliant, and preserves the copyright balance.

Update: The NDP runs a "reality check" that highlights the Haggart article.

With the copyright bill - Bill C-32 - being introduced this afternoon, it is worth noting that my technology law column last week (Toronto Star version, homepage version) focused on some of the key issues likely to find their way into the bill.  The column noted the internal dynamics that led to the bill are by now fairly well known.  Industry Minister Tony Clement, emboldened by last summer’s copyright consultation that generated unprecedented public participation, argued for a forward-looking, technology neutral bill with flexibility as a core principle.  Canadian Heritage Minister James Moore advocated for a U.S.-style protectionist approach, with priority given to digital locks that can be used to limit copying, access, and marketplace competition.

With the active support of Prime Minister Stephen Harper, Moore won the fight over digital locks and the new bill will feature provisions certain to please the U.S. government and lobby groups.  Yet the bill will include far more than just tough legal protection for a digital locks.  

This brief unofficial user's guide to the new legislation that focuses on three key issues - fair dealing, Internet provider liability, and digital locks (Internet downloading is unlikely to figure prominently in the bill).


First, the bill is certain to include a handful of changes to the current fair dealing provision. The Supreme Court of Canada has ruled that Canada's fair dealing provision - which is similar though not identical to fair use in the U.S. - must be interpreted in a broad and liberal manner. Yet the law currently includes a limited number of categories (research, private study, criticism, news reporting, and review) that renders many everyday activities illegal.  

During the copyright consultation, many Canadians called for the introduction of a flexible fair dealing provision that would legalize many common activities.  This is an issue that touches everyone.  Creators would benefit from a parody and satire exception. Consumers would benefit from exceptions for recording television shows or changing the format of content they have purchased. Educators would benefit from exceptions to cover teaching activities and distance education.

Sources say the government has rejected the flexible fair dealing approach, but that new exceptions will make their way into the bill.  The scope of the exceptions - the last bill contained 12 conditions in order to legally record a television show - will go a long way to determining whether the bill tries to strike a balance between competing copyright interests.

Second, the bill will address the responsibility of Internet intermediaries such as Internet providers and search engines for the activities of their users and subscribers.  The past two copyright bills both struck a reasonable compromise by adopting an approach that gave copyright holders the ability to warn users about alleged infringements, but protected the privacy and free speech rights of the public.  The bill will likely adopt the same system once again, which should garner support from across the spectrum.

Third, the bill will include digital lock provisions, known as anti-circumvention rules.  These rules, which will allow Canada to implement international copyright treaties it signed over ten years ago, was the most-discussed issue during the consultation.  Thousands of Canadians argued that Canada should adopt a flexible implementation that renders it illegal to “pick a digital lock” for the purposes of copyright infringement, but preserves the right to do so for legal purposes.

Sources say the government has rejected the flexible approach in favour of the U.S.-style ban on circumvention (subject to a handful of limited exceptions).  If true, the problem with the approach is that it undermines both the new and existing exceptions.  For millions of Canadians, that means that their user rights will be lost whenever a digital lock is present including for CDs, DVDs, electronic books, and many other devices.  In the process, the balance will tilt strongly away from consumers and their property rights over their own purchases.

The government has placed the forthcoming copyright bill on the Notice Paper, which means that the bill could be introduced as soon as tomorrow.  The campaign to support the bill has also begun, with an op-ed in today's National Post jointly authored by Industry Minister Tony Clement and Canadian Heritage Minister James Moore.  The op-ed throws out lots of statistics about the digital and cultural economies and tries to make the case that it has been years since the last update (it references how the current bill is more than 80 years old, but then states that at the last update Canadians used CD players, pagers, and Sega Genesis - not exactly an eternity given that many still use CD players and pagers).

A word cloud of the op-ed would focus primarily on two words - balance and modernization.  Both words appear repeatedly in the piece, with the Ministers emphasizing that the bill will be balanced and that modernizing the law is long overdue.  This suggests that the C-61 communication line of a "made in Canada" has been dropped, which makes sense given the digital lock provisions will reflect a made-in-the-USA approach.

With the next round of Anti-Counterfeiting Trade Agreement negotiations scheduled for later this month in Lucerne, Switzerland (governments have been painfully slow this round in confirming dates, location, and agenda), the global politics behind the agreement escalated over the weekend with Indian officials acknowledging that they plan to establish a coalition of government opposed to the agreement.  Reports indicate that a major concern involves the possible seizure of goods in transit, which raises access to medicines fears with the potential detention of generic pharmaceuticals.

If India is able to line up a coalition of opposition - likely allies include Brazil, China, and Egypt - this will unquestionably escalate pressure on the ACTA countries to open the process.  I have previously argued that ACTA represents a major threat to WIPO and the Development Agenda.  The opposition from the U.S. and E.U. on a treaty for the visually impaired at a meeting last week in Geneva provides further evidence that with IP enforcement effectively removed from within WIPO's scope, those countries will have little incentive to advance the IP development concerns of the rest of the world. 

While some may suggest that the opposition provides evidence that ACTA is on the right track, the reality is that ACTA is largely designed to apply to the very countries that are now preparing to openly oppose it.  There is no mechanism to "force" these countries to abide by ACTA standards.  The best approach to gaining broader acceptance is to include those countries in the talks, not leave them on the outside in the hope of later pressuring them to comply with an agreement from which they were deliberately excluded.

Last week Industry Minister Tony Clement unveiled two bills touted as important components of the government’s national digital strategy.  The Fighting Internet and Wireless Spam Act is a repeat of the anti-spam bill that passed through the House of Commons last year but died after Parliament prorogued.  Since the new bill reflects roughly the same compromise that garnered all-party support, it should receive swift passage.

My weekly technology law column (Toronto Star version, homepage version) argues that the second bill, the Safeguarding Canadians' Personal Information Act, is likely to be far more controversial.  The bill amends Canada’s existing privacy legislation by establishing new exceptions for businesses and new powers for law enforcement.


The centrepiece is a long overdue security breach disclosure requirement. Over the past seven years, virtually every U.S. state has enacted disclosure rules that compel organizations that suffer a security breach that places personal information at risk to promptly disclose that fact to the affected individuals.  By mandating notification, the laws ensure that individuals are better able to guard against identity theft by closely monitoring their credit card bills, bank accounts, and credit reports for any unusual activity.

From a business perspective, the laws create a strong incentive to protect personal information since the notification process is both expensive and embarrassing.  Moreover, the laws have persuaded some organizations to rethink the amount of personal information they retain, since mounting data collection and retention increases the damaging consequences of a security breach.

The Canadian proposal establishes two requirements.  First, businesses are required to report a "material breach of security safeguards involving personal information under its control" to the Privacy Commissioner.  The business determines whether the breach meets this standard by assessing the sensitivity of the information, the number of individuals affected, and whether there is a systemic security problem.

Second, businesses are required to notify individuals affected by the breach "if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual."  The business makes its own determination of whether there is a real risk by considering the sensitivity of the information and the probability that the personal information will be misused.

While the bill is better than the current situation where there is no security breach disclosure requirement, it falls far short of the rules found elsewhere.  The government’s proposal sets a very high threshold for disclosure of a breach and contains no clear penalties for non-disclosure.

By comparison, the California law establishes a threshold of whether an unauthorized person acquired the information, not whether there is real risk of significant harm (other states merely require harm, not significant harm).  Moreover, the California law requires disclosure in the most expedient time possible and without unreasonable delay - far quicker than the Canadian plan.

Some states also establish tough penalties for failure to promptly notify.  For example, Florida's law provides for penalties of up to US$500,000 for failure to notify affected individuals and up to US$50,000 for failure to document non-notifications of security breaches.

Security breach disclosure was widely recognized as a major hole in the Canadian law framework, yet this proposal is a disappointment that falls short of striking the right balance between protecting Canadians, encouraging appropriate safeguards of personal information, and guarding against overwhelming Canadians with too many notices.

In fact, with no penalties for failure to notify security breaches, the provisions may do more harm than good.  If it becomes law, Canadians will expect to receive notifications in the event of a breach, but companies may err on the side of not notifying, safe in the knowledge that there are no established financial penalties for failing to do so.