-
Jan 12, 2025 | 
mondaq.com | Lyndsay A. Wasser |Robbie Grant
In a much-anticipated decision that may have ripple effects inother jurisdictions, the British Columbia Supreme Court hasprovided clear guidance on the application of the PersonalInformation Protection Act, SBC 2003, c 63("BC PIPA") to foreignorganizations. In Clearview AI Inc. v. Information and Privacy Commissionerfor British Columbia, the Court upheld the Office of theInformation and Privacy Commissioner for British Columbia's("OIPC") order against Clearview AI Inc.
-
Sep 19, 2024 | 
mondaq.com | Lyndsay A. Wasser
You may have noticed a common theme throughout our last four
issues: providing employee training is a key action item in
ensuring an effective Canadian privacy compliance program.
Employees are often the "weak link" in an
organization's privacy and data security program.
-
Sep 11, 2024 | 
mondaq.com | Lyndsay A. Wasser
Under Canadian privacy laws, individuals have certain rights
with respect to their personal information
("PI").
-
Sep 5, 2024 | 
mondaq.com | Lyndsay A. Wasser
Under Canadian privacy laws, organizations that transfer
personal information ("PI") about
customers, employees or other parties to a third party vendor for
processing remain responsible for the protection of that PI.
For example, the federal Personal Information Protection and
Electronic Documents Act ("PIPEDA")
requires an organization to use contractual or other means to
provide a comparable level of protection while PI is being
processed by a third party.
-
Sep 3, 2024 | 
lexology.com | Lyndsay A. Wasser
Under Canadian privacy laws, organizations that transfer personal information (“PI”) about customers, employees or other parties to a third party vendor for processing remain responsible for the protection of that PI. For example, the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) requires an organization to use contractual or other means to provide a comparable level of protection while PI is being processed by a third party.
-
Aug 30, 2024 | 
mondaq.com | Lyndsay A. Wasser
Canadian privacy and data protection laws are consent-based. For
the private non-health sector, express or implied consent is always
required to collect, use or disclose personal information
("PI"), subject to limited exceptions
that vary across jurisdictions. Unlike other countries, most
Canadian laws do not recognize "legitimate interests", or
even "performance of a contract", as lawful bases to
process PI without consent.
-
Aug 29, 2024 | 
mondaq.com | Lyndsay A. Wasser
Privacy Impact Assessments (PIAs) are a
critical compliance and governance tool, which can help
organizations to ensure that new projects and personal information
processing activities comply with applicable privacy and data
protection requirements across Canada.
In some circumstances, a PIA is mandated by legislation.
-
Aug 28, 2024 | 
mondaq.com | Lyndsay A. Wasser |Robbie Grant
Canadian privacy law requirements have evolved significantly
over time, including based on regulatory guidance and case law. It
can be hard for businesses to keep on top of their obligations. In
particular, there are five (5) common areas in which Canadian
businesses often have gaps in their privacy compliance
programs:
1.
-
Aug 20, 2024 | 
lexology.com | Lyndsay A. Wasser
Canadian privacy and data protection laws are consent-based. For the private non-health sector, express or implied consent is always required to collect, use or disclose personal information (“PI”), subject to limited exceptions that vary across jurisdictions. Unlike other countries, most Canadian laws do not recognize “legitimate interests”, or even “performance of a contract”, as lawful bases to process PI without consent.
-
Aug 13, 2024 | 
lexology.com | Lyndsay A. Wasser |Robbie Grant
Canadian privacy law requirements have evolved significantly over time, including based on regulatory guidance and case law. It can be hard for businesses to keep on top of their obligations. In particular, there are five (5) common areas in which Canadian businesses often have gaps in their privacy compliance programs:1.
