Privacy & Data Management Blog

Big changes are coming to B.C.’s privacy laws. Effective February 1, 2023, new Freedom of Information and Protection of Privacy Act (“FIPPA”) sections (36.2 and 36.3) and regulations will come into force. For the first time, a B.C. privacy law will require breach reporting and the implementation of a privacy management program.

Breach Notification

B.C. public ...

Your employees are probably engaging in risky online behaviour while at work. With a view to helping with your cyber-hygiene and legal compliance, we have set out a few reasons we know this and some tips to address it.

We routinely see cyber incidents, big and small, arise from employee behaviour. Sometimes, they are intentional acts of a rogue employee. Often, employees are ...

In the latest class action decision involving the Insurance Corporation of British Columbia (“ICBC”), the British Columbia Supreme Court (“BCSC”) found ICBC vicariously liable for a rogue employee’s privacy breaches (Ari v. Insurance Corporation of British Columbia, 2022 BCSC 1475 (“Ari”)). This surprising decision has important implications for ...

With increasing numbers of Canadians being immunized each day against COVID-19, the question on many peoples’ minds is whether Canadians will be asked to prove they are vaccinated by way of a vaccine passport. Vaccine passports can take a range of forms, but the defining feature is a verified record of a person’s immunization status.

The question many employers are now ...

All indications are that the evolution of privacy laws and their impact will continue to evolve, perhaps even at a greater pace, in 2021. In celebrating Privacy Day, January 28, 2021, we would like to share four things businesses should be keeping their eyes on, and planning for, in 2021.

1. Significant changes to privacy legislation in Canada.

Canadian federal and ...

The Privacy Commissioners of Canada, Alberta and British Columbia issued a joint investigation report, finding that Cadillac Fairview did not obtain adequate consent for the collection of digital images of faces through facial recognition technology (Anonymous Video Analytics) installed in wayfinding directories in some of their Canadian shopping malls.

Is consent ...

The Office of the Privacy Commissioner of Canada (“OPC”) has now decided^[1] that the Personal Information Protection and Electronic Documents Act (“PIPEDA”) does not require organizations to obtain separate express consent for the transfer of personal information to service providers located outside of Canada.

The recent decision makes it clear, however ...

Today’s decision by the European Court of Justice (Schrems II) invalidated the US Privacy Shield as a basis for privacy protections permitting the transfer of personal data outside of the EU. The decision has many implications for international commerce, including businesses operating in Canada.

One result is that Canada may become a preferred choice for data storage ...

As businesses begin to reopen, many organizations will examine ways to protect their workers and attract returning customers. Various mechanisms to screen customers for COVID-19 risks will become more common. Examples include providing customers with questionnaires regarding their travel history, exposure to others, and symptoms, or temperature scanning before ...

Canada’s Competition Bureau determined Facebook Inc. made false or misleading claims about the privacy of Canadians’ personal information on Facebook and Messenger. Facebook Inc. will pay a $9 million penalty in a settlement as a result, and pay an additional $500,000 for investigation costs.

This settlement is an important indicator of the shift that Canada’s ...