The Privacy Officer’s Guide to the Personal Information Protection and Electronic Documents Act, 2022 Edition

A new era of proactive enforcement
Revised and updated with recent cases and regulatory guidance, this guide is an essential reference on compliance with Canada's privacy law regime to help privacy officers and organizations cope with the everchanging landscape of privacy obligations in an era in which Commissioner Therrien is revisiting past positions of the Office of the Privacy Commissioner of Canada and embarking on more aggressive enforcement.

Part 1 of this Guide explains in detail the operative provisions of Part 1 of PIPEDA and Schedule 1 relating to personal information protection. Part 2 of this Guide explains the electronic documents provisions of Parts 2 to 6 of PIPEDA and the related Schedules.

Features

• Clear explanation of the law and case summaries relating to:
  • Collection responsibilities for particular types of personal information
  • Meaningful consent requirements and detailed examples of Commissioner findings on the adequacy of consent
  • Appropriate uses of personal information
  • Application to employees of federal works, undertakings and businesses
  • When disclosure and sharing is permitted
  • Security incidents and data breach reporting requirements
  • Outsourcing and cross border transfers
  • Enforcement framework
• Full text of the Act and the Regulations organized thematically to permit the reader to locate commentary, cases and guidance regarding a concept in one place

Highlights of the 2022 Edition

• A thorough discussion (in each relevant Part of the guide) of Bill C-11, the Digital Charter Implementation Act, 2020, which would repeal parts of PIPEDA and enact in its place the Consumer Privacy Protection Act
• A handy and practical new Table of Concordance which outlines the similarities and differences of the Consumer Privacy Protection Act to PIPEDA
• In-depth analysis of new key decisions such as:
  • 3510395 Canada Inc. v. Canada (Attorney General), [2020] F.C.J. No. 674 (Q.L.) (F.C.C.). (“CompuFinder”) where the constitutionality of Canada’s Anti-Spam Legislation (“CASL”) was challenged
  • Canada (Information Commissioner) v. Canada (Minister of Public Safety and Emergency Preparedness) [2019] F.C.J. No. 1251, (“Sig Sauer”) – principles determining what constitutes “Personal Information”
  • R. v. Jarvis [2019] S.C.J. No. 10 (Q.L.) (S.C.C.) & R. v. Mills [2019] S.C.J. No. 22 (Q.L.) (S.C.C.) –Supreme Court decisions on privacy interests and expectations
  • Setoguchi v. Uber B.V., [2021] A.J. No. 22 (Q.L.) (Alta. Q.B.) (“Uber”) – class action case in respect of a data breach that involved the personal information of Uber drivers
  • Joint investigation of Clearview AI, Inc. by the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Information and Privacy Commissioner for British Columbia, and the Information Privacy Commissioner of Alberta, [2021] C.P.C.S.F. No. 3 (P.C.C.) – biometric identifiers created from images of faces obtained from publicly accessible online sources
• Substantially-revised and updated Chapter 4 “Exceptions to the Consent Requirement”, including analysis of developments concerning the collection and use of publicly available information and compliance with laws and other mandatory discourses
• Discussion about recent issues of concern such as:
  • Facial Recognition & Facial Detection technologies
  • Video Analytics, Wearables and the “Internet of Things”
  • Opinions included within the scope of “Personal Information”
• Updated Table of Commissioner’s Findings

Who Will Benefit

• Organizations that deal with personal information, including financial institutions, professional firms, private health care providers, private educational institutions, private investigators, consumer reporting agencies and all manner of businesses that have occasion to handle personal information
• Service providers to such organizations, including privacy, security and information management consultants and data processors
• Compliance and privacy officers and information managers
• Legal practitioners, including privacy lawyers, corporate and commercial lawyers, IP lawyers, health lawyers, litigators, and corporate counsel
• Individuals who want to:
  • Ensure the protection and appropriate use of their personal information that is collected or generated in connection with the purchase of goods or services, employment or any other activity
  • Gain access to, and ensure the accuracy of, such information