The Privacy Officer’s Guide to Personal Information Protection and Electronic Documents Act, 2020 Edition

Formerly A Guide to Personal Information Protection and Electronic Documents Act

A new era of proactive enforcement
Revised and updated with recent cases and regulatory guidance, this guide is an essential reference on compliance with Canada's privacy law regime to help privacy officers and organizations cope with the everchanging landscape of privacy obligations in an era in which Commissioner Therrien is revisiting past positions of the Office of the Privacy Commissioner of Canada and embarking on more aggressive enforcement.

Part 1 of this Guide explains in detail the operative provisions of Part 1 of PIPEDA and Schedule 1 relating to personal information protection. Part 2 of this Guide explains the electronic documents provisions of Parts 2 to 6 of PIPEDA and the related Schedules.

Features

• Clear explanation of the law and case summaries relating to:
  • Collection responsibilities for particular types of personal information
  • Meaningful consent requirements and detailed examples of Commissioner findings on the adequacy of consent
  • Appropriate uses of personal information
  • Application to employees of federal works, undertakings and businesses
  • When disclosure and sharing is permitted
  • Security incidents and data breach reporting requirements
  • Outsourcing and cross border transfers
  • Enforcement framework
• Full text of the Act and the Regulations organized thematically to permit the reader to locate commentary, cases and guidance regarding a concept in one place

Highlights of the 2020 Edition

• Recently revised OPC Guidelines on obtaining meaningful consent (effective January 1, 2019) and how the OPC has applied the guidelines
• In-depth analysis of key decisions such as:
  • Royal Bank of Canada v. Trang, 2016 SCC 50 (S.C.C.) (analytical framework to be used to determine when express consent or implied consent is appropriate)
  • Investigation into Equifax Inc. and Equifax Canada Co.'s compliance with PIPEDA in light of the 2017 breach of personal information, [2019] C.P.C.S.F. No. 1 (Can. Priv. Comm.) (massive data breach)
  • Joint investigation of Facebook, Inc. by the Privacy Commissioner of Canada and the Information and Privacy Commissioner for British Columbia, [2019] C.P.C.S.F. No. 2 (Can. Priv. Comm.) (Facebook’s accountability for personal information in its control)
  • Vadivelu v. State Farm Mutual Automobile Insurance Co. [2018] O.F.S.C.D. No. 102 (Arb.) (collection of personal information for witness statements for insurance claims)
• Discussion about recent issues of concern such as:
  • Privacy issues arising from speech recognition technology
  • Right to Erasure or to be Forgotten
  • Right to De-Indexing
• Update on OPC’s 2018 application to Federal Court of Canada regarding Google’s search engine

Who Will Benefit

• Organizations that deal with personal information, including financial institutions, professional firms, private health care providers, private educational institutions, private investigators, consumer reporting agencies and all manner of businesses that have occasion to handle personal information
• Service providers to such organizations, including privacy, security and information management consultants and data processors
• Compliance and privacy officers and information managers
• Legal practitioners, including privacy lawyers, corporate and commercial lawyers, IP lawyers, health lawyers, litigators, and corporate counsel
• Individuals who want to:
  • Ensure the protection and appropriate use of their personal information that is collected or generated in connection with the purchase of goods or services, employment or any other activity
  • Gain access to, and ensure the accuracy of, such information