Large providers can foot the bill for these obligations, albeit still expensive and risky, but for small providers, they can be absurd. A family-run online store, a regional software company, a small hosting provider, or even a doctor or lawyer sending out emails do not have the security team of a bank or a major privacy company.

Grandma Beth, running her flower shop that takes online orders, doesn’t have full-time legal counsel or system engineers to ensure that her government-mandated database of customer information is secure from modern threats. The politicians in Ottawa might say that this is not who the legislation is intended for, but the law is what is written in the pages of the bill, and currently its broad language leaves room for these obligations to land far outside the group of companies actually equipped to handle them.

Once a business is required to collect or retain data it would otherwise avoid keeping, the privacy of citizens, by nature, is more at risk. The more of your information that is stored somewhere, the more opportunities there are for criminals, hostile states, malicious insiders, and identity thieves to get at it. Canada has spent years telling organizations to collect less data because data minimization reduces breach risk, yet introduces a bill which goes completely against that philosophy.