Privacy Impact Assessments in Canada

Abstract

Over the last 20 years or so, a range of new policy instruments has entered the “toolbox” of those regulators charged with implementing and enforcing information privacy and data protection policy. During the earlier history of these policies, it was generally assumed that law alone, codifying the information privacy principles and establishing independent oversight, would be both necessary and sufficient to regulate the collection, use and dissemination of personal data by organisations. The assumptions have shifted. Now, it is generally assumed that law is necessary, but not sufficient.