We use cookies to give you the best online experience. By using our website you agree to our use of cookies in accordance with our cookie policy. Learn more here.Close Me
The European Union's General Data Protection Regulation
(GDPR) came into force on May 25, 2018. To assist Canadian
organizations with their potential compliance efforts with respect
to this legislation, the following is intended to provide a
non-exhaustive, high-level comparison between the consent
provisions of:
the GDPR;
Canada's Personal Information
Protection and Electronic Documents Act (PIPEDA);
the Personal Information Protection
Acts of Alberta and British Columbia (collectively, the PIPAs);
and
Canada's Anti-Spam Legislation
(widely known as CASL).
While there are important nuances to each of these regulatory
frameworks, they broadly draw on fair information practices that
result in substantial commonality among them. In fact, a number of
elements in Canadian private sector privacy law, especially in the
PIPAs, have anticipated some provisions in the GDPR.
EXPRESS CONSENT
The Alberta and B.C. Privacy Commissioners have held that
consent must be "meaningful" (i.e., an
individual must understand what an organization is doing with their
information).
On or before collecting personal information about an
individual, an organization must generally disclose to the
individual verbally or in writing: (i) the purposes for the
collection of the information; and (ii) the position name or title
and the contact information of a person who is able to answer the
individual's questions about the collection. Consent can also
be implied or deemed in certain circumstances.
The PIPAs provide that an organization shall not, as a condition
of supplying a product or service, require an individual to consent
to the collection, use or disclosure of personal information about
an individual beyond what is necessary to provide the product or
service.
Canada's privacy regulators plan to adopt new guidelines
applicable to meaningful consent as of January 1, 2019.
Originally published by Canadian Privacy Law Review
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
For the last number of years, Ponemon Institute has published reports on data breaches. The latest report, "2018 Cost of a Data Breach Study: Global Overview" (the "Report"), is worth the read.
A few days ago, a friend forwarded on the Slashdot story about Facebook paying individuals, ages 13-35, $20/month to essentially spy on them. The story is all over the Internet, apparently.
On 14 January 2019, the Singapore privacy regulator, PDPC (Personal Data Protection Commission) issued fines totalling SGD$1 million against SingHealth and IHiS for a data breach involving its patient database.
The Office of the Privacy Commissioner of Canada recently released a guidance document for Canadian private sector cannabis retailers who collect personal information from their customers.
How To Prepare For, Prevent And Repair Online Data Leaks (Video)
