Privacy Law Reform and Greater Corporate Accountability Towards Protection of Personal Information

On November 17, 2020, the proposed Digital Charter Implementation Act, 2020, (the “Act”) was introduced. If passed, it will introduce massive changes to the way in which personal information is used, collected, and stored.

The proposed framework seeks to accomplish these goals by strengthening the powers of the Privacy Commissioner to impose harsher penalties for violations of privacy rights and by creating incentives for companies to comply with privacy legislation, specifically regulating the way in which personal information is collected through meaningful consent.

The new framework envisioned by the Act empowers the Privacy Commissioner with order-making powers to recommend that fines be imposed, which can account for up to 5% of global revenues (at the ultimate determination of a new administrative tribunal, the Personal Information and Data Protection Tribunal) or to request that companies delete information improperly obtained or withheld. These fines are the strongest among G7 countries for privacy laws.

The purpose of this legislation is not necessarily to impose harsher penalties, but rather, to use these mechanisms among others as a way to incentivize corporations to work with the Privacy Commissioner to develop policies that are compliant with and demonstrates a respect for privacy rights.

For individuals, the Act means that corporations collecting personal information will be required to obtain meaningful consent; in other words, individuals must have plain-language information about the proposed collection, use, and disclosure of personal information. The Act also proposes that individuals will have greater control over their personal information whether it is to withdraw consent for use of their information or it is to direct the transfer of their personal information from one organization to another. What is clear is that this new legislation aims to give individuals greater decision-making power over how their information is used, stored, collected – before and after the information has been disclosed.

If passed, corporations should review their privacy policies with a fine-toothed comb to ensure that this level of transparency and flexibility is available to individuals when relying on the use of personal information.

The post Privacy Law Reform and Greater Corporate Accountability Towards Protection of Personal Information appeared first on FCL LLP.

There is an immediate need in our community to disseminate legal knowledge without the exorbitant price tag attached. To respond to this gap, there has been an influx of new legal apps in the Canadian market. While these services serve the much needed goal of providing access-to-justice to consumers by offloading the financial burden, researchers shed light on the serious privacy concerns that form the adverse side of such innovative technology.

A team of researchers from the University of Ottawa, Faculty of Law assessed legal apps from a privacy lens and compiled guidelines to subvert the confidentiality issues that arise when using such apps [1]. While many mobile apps are susceptible to weak privacy protection barriers, the researchers flag legal tech to be at the forefront of these issues. Many of these apps collect highly sensitive personal information in order to provide assistance, with little attention to safeguarding the privacy of its user from unauthorized third-party collection, or without due attention to the compliance with privacy laws.

Additionally, consumers are often not made aware that while lawyers may design these apps, the confidential information shared on these apps are not protected by solicitor-client privilege. This privilege, while sacrosanct between a client and their lawyer, does not extend to algorithms.

Many of these apps are developed by legal professionals or students with the intent of solving socio-legal issues, but who often lack the requisite computer science know-how to truly build in adequate privacy measures. A number of these apps are not monetized initially and therefore not under the purview of governing privacy legislation. As such, the authors found that at the inception stage of many apps, there is little awareness or implementation of legislation such as PIPEDA.

The authors warn consumers about freely sharing private information on such apps without conducting proper due diligence with respect to the security measures available. The authors advise the legal community participating in the legal-tech sphere to contemplate the importance of adhering to and implementing privacy guidelines at the design stage of building legal apps.

While legal apps are essential in bridging the access-to-justice needs in our community, it is important to engage in these projects with the ultimate goal of protecting the identity and information of its users. If privacy measures are only contemplated at the commercialization stage, it is already too late.

[1] Teresa Scassa, Amy Salyzyn, Jena McGill and Suzanne Bouclin, Developing Privacy Best Practices for Direct-to-Public Legal Apps: Observations and Lessons Learned. (2020) 18:1 Canadian Journal of Law and Technology.

The post Legal Apps – A Double Edged Sword appeared first on FCL LLP.

All Canadian workplaces are obligated under Canadian Privacy Laws to secure the use, collection, retention, disclosure or disposal of sensitive data. In the legal world, this obligation is doubly compounded by our professional duty to protect the confidentiality of our clients. Law firms therefore, invest in all precautions necessary to secure against risks of unauthorized use of data. This often translates into strict technical and organizational measures to insulate against privacy breaches in practice.

With the rapid spread of COVID-19, the world has witnessed an extraordinary turn of events that could not have been anticipated. To keep operational, law firms have had to promptly adapt to a remote workplace model where employees are working from home. However, given the speed at which this arrangement was implemented, many organizations may not have had systems in place to insulate against the security risks that may arise.

Many employees working from home share equipment and spaces with other family members. Such settings can present situations of unattended documents and notes with sensitive information recorded. Additionally, electronic information may be accessed on devices that are not exclusively for the use of the authorized person. The device itself, may not be equipped with passwords and technical guards that are offered at an office. Employees are now presented with the challenge of discharging the same duties to secure confidential material, but without the infrastructure in place to do so. Therefore, the current climate of mass disruption, has made organizations particularly susceptible to privacy breaches or cyber attacks.

It is important for organizations to take immediate steps to ensure the protection of sensitive information. These steps include:

Updating and implementing security measures

• Employers need to update their privacy policies and procedures to reflect the current needs, issues, and solutions surrounding a remote workplace;
• Employers need to consider the risks of cyber attacks and have measures in place to respond to any security breaches;
• Employers need to invest in revamping their IT infrastructure to ensure employees have access to a secure remote platform. These measures may include providing a protected VPN connection to employees which encrypts confidential communication;
• Employers should utilize access-based security features such as a multi-factor authentication protocol to protect their employees’ accounts; and,
• Employers should closely monitor network-related activities to flag security breaches.

Training employees

• Employee training should focus on how to manage security risks from home. Some of these measures include the use of a secure location such a locked cabinet to limit the exposure of confidential information to family members;
• Employees should password protect all devices, and access confidential documents through a centralized and secured device; and,
• Employees should use electronic platforms enabled by the organization so they are connecting to the workplace network through a secure VPN connection that is protected by firewalls and antivirus software.

It is imperative to maintain the integrity of this profession by ensuring that the duty of confidentiality owed to our clients is not compromised under any circumstance. It is incumbent on the prudent organization and employee to jointly make best efforts to conduct our business as securely as possible.

The post Curbing Privacy Risks When Working From Home appeared first on FCL LLP.