GDPR e Privacy Regulation Impacts on Canadian Organizations

GDPR & e. Privacy Regulation: Impacts on Canadian Organizations Bill Hearn, Partner, Fogler, Rubinoff LLP David Young, Principal, David Young Law 1

OVERVIEW • “GDPR 101” for Canadian organizations • GDPR gap analysis from Canadian compliance perspective • “e. Privacy Regulation (“e. P Reg”) 101” for Canadian organizations • What Canadian organizations should be doing now about GDPR and e. P Reg 2

EC DATA PROTECTION WEBPAGE 3

“GDPR 101” for Canadian Organizations 4

“GDPR 101” • • • In force since May 25, 2018 Potentially severe penalties for non-compliance Scope - both substantive and territorial Data subjects’ rights including right to § Object § Data portability § Erasure Controllers and processors - definitions and main obligations including § Data protection by design and by default § Data processing contracts § Notification of data breaches § Data protection officer 5

6

GDPR CENTRAL CONCEPTS AND KEY CHANGES – OVERVIEW Source: Hengeler Mueller LLP (Germany) 7

DATA SUBJECTS’ RIGHTS Source: U. K. Information Commissioner’s Office 8

A GDPR GAP ANALYSIS FROM A CANADIAN COMPLIANCE PERSPECTIVE 9

OVERVIEW • Obligations of controllers – accountability, infrastructure compliance, security, breach reporting • Obligations of processors – direct application of the law, contracting requirements, extra-territorial reach, cross-border transfers • Consent – how does it differ from the PIPEDA rules? • Legitimate interests – alternative to consent – when is it available? 10

OVERVIEW Short Term – First Year after May 25, 2018 • Show your commitment to GDPR – document and plan your GDPR implementation; analyze and document data processing in your company • Appoint a DPO • Visibility: Check your website and get your data policy right • Prepare for and deal with information requests • Switch off obviously non-compliant features Medium to longer term • Privacy by design, privacy by default (unless you are in direct focus) • Data portability • Automation of processes 11

OBLIGATIONS OF CONTROLLERS 12

OBLIGATIONS OF CONTROLLERS GDPR RULES PIPEDA RULES Accountability Controller is responsible for and must be able to demonstrate compliance with the Data Protection Principles (Article 5 (2)) Organization is responsible for PI under its control (Principle 1) Privacy infrastructure Controller is responsible for implementing appropriate technical and organizational measures to ensure and to demonstrate compliance with the GDPR, which may include appropriate privacy policies (Article 24) Organization must implement policies and practices to give effect to PIPEDA’s ten Principles (Principle 1) and develop a comprehensive privacy management program that includes controls to give effect to the Principles (OPC/Alberta/BC guidance document – Getting Accountability Right) Controller needs to provide infrastructure for data subjects’ possible requests to data access, erasure (Article 15, 17, recital 63) and need to inform data subjects as soon as personal data is collected or obtained (Article 14, 15) 13

OBLIGATIONS OF CONTROLLERS GDPR RULES PIPEDA RULES Appointment of data protection officer (“DPO”) Appointment of privacy officer Controller must appoint a DPO if its activities include regular Organization must appoint an individual to oversee its and systematic monitoring of data subjects or processing compliance with the Principles (Principle 1; Getting sensitive personal data on a large scale Accountability Right) A DPO should have expert knowledge of data protection law and practice; the organization cannot instruct the DPO in the performance of his or her duties, and cannot terminate the DPO's employment Data protection by design and by default Privacy by design In both the planning and implementation phases of any new product or service, the Data Protection Principles and appropriate safeguards must be addressed and implemented; (Article 25) - e. g. , when designing products, processing of personal data must be minimized and dataprotection-friendly pre-settings must be used (sliders, preticked boxes) In developing new products or business models, a holistic view of privacy protection should be undertaken – i. e. , privacy should be built into the design stage (Privacy, Trust and Innovation – Building Canada’s Digital Advantage, OPC policy submission, July 2010) 14

OBLIGATIONS OF CONTROLLERS GDPR RULES PIPEDA RULES Contracting with data processors Service provider management Contracts must contain stipulated provisions including compliance with controller’s instructions, confidentiality and security (Article 28) An organization is responsible for data transferred to a third party for processing and shall use contractual or other means to provide comparable protection (Principle 1) Contracts should include requirements to comply with controller’s policies and procedures (e. g. security and confidentiality standards, protocols), notification of controller of breaches, training and education for service provider employees and agreements to comply with controller’s policies, audits of processor’s activities (Getting Accountability Right) Record keeping requirements Record-keeping requirements A controller must keep records of all processing activities including purposes, categories of data and subjects, recipients, cross border transfers, retention periods and security measures (Article 30) Organizations should - develop guidelines and procedures with respect to retention of personal information, including retention periods (Principle 5) - develop a personal information inventory (Getting Accountability Right) - be open about their policies and practices respecting management of PI including descriptions of the types of PI processed and its uses (Principle 8) 15

OBLIGATIONS OF CONTROLLERS GDPR RULES PIPEDA RULES Data Security A controller must implement appropriate technical and organizational security measures which may include encryption, regular security reviews and testing, and backup facilities (Article 32) An organization must protect PI by safeguards appropriate to its sensitivity and its magnitude, location and format, including physical, organizational and technological measures (Principle 7) Such safeguards must be based on risk assessments and ongoing reviews and be documented by appropriate PI and network security policies (OPC/Alberta/BC guidance document - Securing Personal Information: A Self. Assessment Tool for Organizations) Reporting data breaches Must report any breach likely to result in harm to data subjects As soon as feasible after an organization determines a breach within 72 hours, including stipulated information describing the of security safeguards involving PI that creates a real risk of breach, likely consequences, and remedial measures (Article significant harm to an individual has occurred 33) Notifying individuals of a breach Notifying data subjects of a breach Must notify the affected individuals of the breach including Must notify affected data subjects without delay if breach providing a description of the circumstances, the PI and poses high risk to them, including notice of likely number of individuals involved, remedial measures and consequences and remedial measures taken (Article 34) measures the individuals can take to mitigate the risk 16

OBLIGATIONS OF CONTROLLERS GDPR RULES PIPEDA RULES Obligation to conduct impact assessments Risk assessments Must be conducted where a new processing activity is proposed resulting in a high degree of risk for data subjects. Organizations should conduct risk assessments, at least on an annual basis, to ensure compliance. Risk factors include: evaluation of data subjects e. g. , work and health; automated decision-making having a significant impact e. g. , credit refusal; systematic monitoring; processing sensitive data; large scale processing; data matching; if it affects vulnerable individuals; and cross border transfers (Article 35) Assessments with respect to new services or projects involving PI including any new collection, use or disclosure of PI should be conducted through the use of privacy impact assessments and security threat risk assessments (Getting Accountability Right) 17

OBLIGATIONS OF PROCESSORS 18

OBLIGATIONS OF PROCESSORS GDPR Rules PIPEDA Rules Direct application to processors Service providers (i. e. , processors) are not directly subject to PIPEDA Requirement to: keep data confidential, including employee obligations; comply with controller’s instructions; controllers (with some exceptions) have the duty to prepare, update and provide to the DPA on request records (overview documents) of processing activities including categories, cross border transfers and security measures; implement appropriate security measures which may include encryption, regular security reviews and testing, backup facilities; notify controller of any data breach without undue delay; and appoint a DPO in same circumstances as a controller (Article 28 et seq. ) But must comply with protective requirements stipulated under contracts with their client organizations (Principle 1) Contracts should include requirements to comply with controller’s policies and procedures (e. g. , security and confidentiality standards, and protocols), notification of controller of breaches, training and education for service provider employees, agreements to comply with controller’s policies, and audits of processor’s activities (Getting Accountability Right) 19

OBLIGATIONS OF PROCESSORS GDPR RULES PIPEDA RULES Potential application to processors whether or not processing takes place in the EU if: Indirect application to service providers wherever located, through contract: (a) the data processing supports the activities of an EUestablishment of either the processor or the controller (even when processing takes place outside the EU); or Client organization is responsible for protection of data held by service provider including if transferred across borders (Principle 1) (b) with no regard to an EU-establishment: the processing activity is related to an offering of goods/services to a person inside the EU, or personal data of a person inside the EU is monitored (e. g. , tracking/targeting of personal data) Note: direct application of GDPR’s cross-border transfer rules to processors and controllers Cross-border transfers require an adequacy decision by the European Commission – e. g. , PIPEDA or “appropriate safeguards” – e. g. Privacy Shield ((Articles 45(1), (3), 46 (1)) 20

LEGITIMATE INTERESTS AND CONSENT 21

LEGITIMATE INTERESTS GDPR RULES PIPEDA RULES “Legitimate interests” of the controller permit processing without consent (e. g. , if data subject is a client or employee) unless overridden by the interests, fundamental rights or freedoms of the data subject which require protection - e. g. , a child. “Reasonable expectations” of the individual may determine whether express or implied consent is required (e. g. , a renewal of a magazine subscription (Principle 3) Legitimate interests must be consistent with the reasonable expectations of the data subject – in other words, expected by the data subject (i. e. , purposes understood by the data subject, not new or different) (Article 6(1)(f)) Express consent is generally required when the collection, use or disclosure is outside the individual’s reasonable expectations or if it poses an increased risk of harm (OPC’s Guidelines for Online Consent, 2018) Implied consent is generally appropriate for less sensitive PI (Principle 3) Direct marketing purposes may be a legitimate interest within the balancing of interests as it is acknowledged by the GDPR (recital 47), and by the Financial Reporting Council (general perception of profession; freedom to conduct a business; freedom of expression – FRC Articles 15, 16, 11) Individuals may object to data processing based on legitimate interests (Article 21); they need to be notified about the processing (Article 13) 22

CONSENT GDPR RULES PIPEDA RULES When valid Must be a freely given, specific, informed and unambiguous – by a statement or clear affirmative action (Articles 4 (11), 6(1)(a), 7) Informed consent is required for the collection, use or disclosure of PI, subject to specific exceptions (such as in emergencies, court proceedings, or if exempt by law) (Principle 3) Invalid if data subject has no free choice (e. g. , bundled up consent as non-negotiable part of terms and conditions) or is unable to refuse or withdraw consent without detriment – “clear imbalance” between controller and subject (e. g. employer and employee) presumes consent not freely given (Article 7 (4)) Silence, pre-checked boxes, inactivity, failure to opt out, or passive acquiescence do not constitute valid consent (recital 32) Consent is only valid if it is reasonable to expect that the individual understands the nature, purpose and consequences of the collection, use or disclosure of PI to which they are consenting (PIPEDA, section 6. 1) Individuals must be given clear options to say “yes” or “no” (OPC Guidelines for Meaningful Consent, 2018) Note: Requirements are hard to meet; consent can be withdrawn at any time; burden of proof for effective consent lies with the controller (Article 7(1), (3)) 23

CONSENT GDPR RULES PIPEDA RULES No bundling (unless necessary for contract performance) No bundling (unless required for legitimate purposes) If a contract is conditional on the data subject’s consent for a use that is not necessary for contract performance, consent may not be freely given (Article 7(4)) An organization shall not, as a condition of the supply of a product or service, require an individual to consent to the collection, use or disclosure of PI beyond that required to fulfill the explicitly specified, legitimate purposes (Principle 3) A contract can be the legal basis for data processing but limited to necessary data, purpose limitation and ban on bundling (Article 6(1)(b)) 24

CONSENT GDPR RULES PIPEDA RULES Making consent “informed” The purposes for which PI is collected shall be identified at or before the time of collection (Principle 2) For consent to be “informed”, the intended uses must be explained in an intelligible and easily accessible form, using clear and plain language not containing unfair terms. The data subject should be aware at least of the identity of the comptroller and the purposes for which data will be used (Article 4 (11), 7 (1)) The “knowledge and consent” rule requires that purposes be stated in a manner that the individual can reasonably understand how the information will be used or disclosed (Principle 3) If data is collected from the subject, information must include any recipients of shared data and any cross-border transfers (Article 13(1)) 25

“e. P REG 101” FOR CANADIAN ORGANIZATIONS 26

e. P REG BENEFITS Source: European Commission 27

e. P REG • The e. P Reg is to replace the existing EU e. Privacy Directive (colloquially known as the “EU Cookie Directive”) * Many GDPR commentators don’t expect the e. P Reg to become law until 2020 § • The e. P Reg was officially published by the European Commission only on January 10, 2017 and is a law separate from the GDPR It complements and is aligned with the GDPR in that § a breach can attract the same severe financial penalties – i. e. , up to the greater of € 20 million or 4% of worldwide turnover § it will be enforced by the same supervising authorities – i. e. , the national privacy and information regulators of EU Member States 28

e. P REG • The e. P Reg attempts to reinforce trust and security in EU’s digital market • It will establish a new privacy legal framework for electronic communications • It has a very wide scope and will broadly apply to any organization that provides any form of online communication service, or that utilizes tracking technologies, or that engages in electronic direct marketing 29

e. P REG • Specifically, the e. P Reg will apply to § organizations anywhere in the world that provide publicly-available “electronic communications services” to users in the EU or that gather data from the devices of users in the EU. It applies even if there is “no charge” for the services § traditional ISPs and telcos … but also to so-called “over-the-top” providers, such as VOIP services, text messages and email providers that are not subject to the current e. P Reg § all electronic communications data which includes both content (i. e. , what was said) and metadata (i. e. , who said it, when, where, and other related info about the communication) § anyone using cookies or similar tracking technologies § Io. T and machine-to-machine communications 30

e. P REG • Among other things, the e. P Reg will § enhance “consent” requirements in line with the GDPR … and end-users will have to be reminded every 12 months of their right to withdraw consent § require website providers to present users with cookie consent choices − some EU legal commentators say this may lead to the end of cookie banners in that clear affirmative action will be required to signify freely given, specific, informed and unambiguous consent to the storage and access of third party tracking cookies − consumers will be the ones setting their privacy settings via their browsers or any mobile apps they use § keep exemption for analytics cookies 31

e. P REG • For direct e-marketing, the e. P Reg provides that § if B 2 C, the sender must obtain the opt-in consent of the recipient … but consent will not be required when marketing similar products and services so long as the recipient is given the opportunity to object and opt-out § if B 2 B, each Member State may put in place whatever it deems appropriate to ensure that the legitimate interests of corporate end-users are sufficiently protected from unsolicited e-communications 32

WHAT SHOULD CANADIAN ORGANIZATIONS BE DOING NOW ABOUT THE GDPR and e. P Reg? 33

GET TO KNOW THE GDPR • • • Canadian organizations must assess to what extent the GDPR applies to their activities and what changes are required to comply The organization’s legal and privacy professionals should make sure that key decision makers within the organization know that, since May 25, 2018, the EU’s privacy law has changed to the GDPR If an organization is somehow unaware of the GDPR, the time to act is NOW! 34

FIGURE OUT IF GDPR APPLIES • Again, many Canadian organizations are subject to the GDPR because they § have an establishment/physical presence in the EU or § collect or process personal data of EU residents for offering goods or services (even at no charge) or § monitor the behaviour of individuals in the EU or § are a third party processor of EU personal data 35

RESTRICT ACTIVITIES OR COMPLY? • • If the GDPR applies to a Canadian organization’s activities, that organization must decide whether § to restrict their activities so that they fall outside of the scope of the GDPR − e. g. , stop providing services to EU residents … or stop processing data from individuals in the EU or § to comply with the GDPR If the decision is made to comply, then the Canadian organization must determine what GDPR obligations apply to it 36

TAKE STEPS TOWARDS COMPLIANCE • • The organization should conduct a compliance assessment of current data protection policies and practices in order to identify gaps in relation to the GDPR’s requirements § If enforcement action is ever taken by the EU in the future, such an assessment may help the organization mount a successful defence or at least mitigate fines Following this assessment, the organization can then develop strategies to achieve GDPR compliance in an effective and cost efficient manner § e. g. , consider whether it is possible for the organization to isolate all of its data that is subject to the GDPR and then implement a compliance plan only in respect of that data (as opposed to a plan across the entire organization) 37

TAKE STEPS TOWARDS COMPLIANCE • • There are many similarities between PIPEDA and the GDPR So, Canadian organizations that are already PIPEDA-compliant have less work to do and should focus on designing and implementing policies and practices regarding those aspects of the GDPR where PIPEDA is not equivalent – such as ensuring the rights of individuals to § data portability (i. e. , to port their personal data to another organization) § erasure (i. e. , right to be forgotten) § object to marketing and to decisions taken by automated processes § breach notification − e. g. , “without undue delay and, where feasible, not later than 72 hours after having become aware of it”; if the notification is not made within 72 hours, the data controller must provide a “reasoned justification” for the delay 38

TAKE STEPS TOWARDS COMPLIANCE • There are several steps for the organization to consider including reviewing and revising where required by the GDPR § consent forms for EU residents § the selection process for, and contracts with, data processors § the qualifications, placement and duties of the organization’s Chief Privacy/Data Protection Officer § DPOs must be independent and not instructed how to do their job § privacy and data protection policies § practices for handling the personal data of EU residents § the organization’s privacy compliance infrastructure (to ensure it satisfies the GDPR’s accountability requirements) 39

ICO PUTS AGGREGATE IQ ON NOTICE 21 st September 2018 The UK’s privacy regulator, the ICO, has given a formal notice to a Canadian firm embroiled in questions over Vote Leave’s use of data during the EU Referendum. Although most of the allegations aimed at how Aggregate IQ and the use of data relate to a period before May 25 this year and are not therefore potentially subject to a fine under GDPR, the ICO is reportedly concerned about how the data continues to be used 40

CMA GDPR GUIDE 41

CONTACT US Bill Hearn Partner, Fogler Rubinoff LLP bhearn@foglers. com 416. 941. 8805 David Young Principal, David Young Law david@davidyounglaw. ca 416 -968 -6286 42