There were several important privacy developments in 2015 that
may potentially impact organizations doing business in Canada in
the year ahead and beyond.
ONE | ONLINE BEHAVIOUR ADVERTISING AND CONSENT
In April, the Office of the Privacy Commissioner of Canada (OPC)
released its investigation report regarding Bell's Relevant Ads
Program (RAP). The RAP involved the creation of Bell Mobility
customer profiles based on demographic and account information
combined with network usage information, such as specific websites
visited and apps used. Bell was to use the profiles to serve
third-party ads, charging fees to the advertisers.
The OPC determined that Bell's use of an opt-out form of
consent for the RAP was not appropriate given the sensitivity of
the information (including sensitive website URLs) and the
reasonable expectations of Bell's customers. According to the
OPC, Bell customers paid a significant amount for their mobile
services and would not reasonably have expected Bell to use
information for further financial benefit without their express
consent. The report also specified that, in the absence of customer
consent, Bell could not create customer profiles and that
it would not be sufficient to simply stop using the
profile for targeted advertising. The report is largely consistent
with previous OPC findings and guidelines relating to online
behaviour advertising and appropriate forms of consent, but it will
nonetheless have a significant impact on businesses engaged in
tracking, profiling and targeting of customers, including in the
rapidly expanding area of the "Internet of Things."
TWO | DIGITAL PRIVACY ACT
In June, the Digital Privacy Act received royal assent.
The act makes a number of amendments to Canada's federal
private-sector privacy statute, the Personal Information
Protection and Electronic Documents Act
(PIPEDA). Perhaps the most significant amendments that may
affect businesses are those that create a scheme for mandatory
breach reporting. Although these particular amendments are not yet
in force, once they become effective, they will require
organizations to notify the OPC of a data breach that poses a
"real risk of significant harm" to affected
Organizations will also be required to notify government
institutions and other organizations in certain circumstances,
including when those entities may be able to reduce or mitigate the
risk of harm to the affected individuals. Further, organizations
will be required to keep records of all data breaches, even those
that do not meet the harm threshold. Knowingly failing to report or
record a data breach is an offence punishable by a fine of up to
Although these provisions are not expected to come into force
until late 2016, organizations are well advised to start thinking
about the policies and procedures that will need to be implemented
to comply with these reporting and record-keeping requirements.
THREE | PROTECTION OF PERSONAL DATA
In October, the Court of Justice of the European Union (CJEU)
released its decision in Schrems v.Data Protection
Commissioner. In that case, the CJEU invalidated the European
Commissioner's decision that allowed the transfer of personal
data from the EU to an organization in the United States, which had
undertaken to comply with EU-U.S. safe-harbour principles. Although
not directly applicable to organizations in Canada, the decision
may, nonetheless, impact Canadian businesses with multinational
operations. It also opens the door to a similar challenge relating
to the European Commissioner's decision that PIPEDA adequately
protects EU personal data, the mechanism by which most transfers of
personal data between the EU and Canada are sanctioned by EU data
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
Please join members of the Blakes Commercial Real Estate group as they discuss five key provisions of a commercial real estate purchase agreement that are often the subject of much negotiation but are sometimes misunderstood.
Emotional culture is influenced in great part by the mindset and actions of leadership, although employees also play more of a role than they may realize in creating the culture that exists in the group.
The session will be led by Dr. Robert Brooks, an award-winning author and psychologist. In his presentation, Dr. Brooks will describe the mindset and realistic practices of leaders and staff that help to nurture and sustain a culture characterized by positive emotions, satisfying, respectful relationships, a sense of meaning and ownership for one’s work, and enhanced job performance. Examples will be offered to illustrate strategies for developing a positive emotional culture in an organization.
Join leading lawyers from the Blakes Pensions, Benefits & Executive Compensation group as they discuss recent updates and legal developments in pension and employee benefits law as well as strategies to identify and minimize common risks.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).