Privacy & Data Management Blog

Facebook admitted in Federal Court that Cambridge Analytica accessed personal information of over 600,000 Canadian Facebook users through a third party application without permission and in breach of Facebook policies.  Nevertheless, the Federal Court decided Facebook did not breach the Personal Information Protection and Electronic Documents Act (“PIPEDA”).

The proposed Consumer Privacy Protection Act (“CPPA”) is intended to replace the Personal Information Protection and Electronic Documents Act. The current text of the CPPA introduces the new concept of “service providers,” and may require organizations to take a different approach to their vendor and service provider agreements.

See our previous blogs about ...

The proposed Consumer Privacy Protection Act (“CPPA”) is intended to replace the Personal Information and Electronic Documents Act (“PIPEDA”). The current text of the CPPA will make a number of significant changes to some of the consent requirements Canadian private sector organizations must obtain.

See our previous blog about CPPA’s proposed privacy ...

Introduction to the CPPA

In June 2022, the federal government introduced Bill C-27, which proposes significant updates to Canada’s federal private sector privacy framework. Bill C-27 is currently in its second reading in the House of Commons. If passed, Bill C-27 would replace the Personal Information and Electronic Documents Act with the Consumer Privacy Protection ...

Big changes are coming to B.C.’s privacy laws. Effective February 1, 2023, new Freedom of Information and Protection of Privacy Act (“FIPPA”) sections (36.2 and 36.3) and regulations will come into force. For the first time, a B.C. privacy law will require breach reporting and the implementation of a privacy management program.

Breach Notification

B.C. public ...

Your employees are probably engaging in risky online behaviour while at work. With a view to helping with your cyber-hygiene and legal compliance, we have set out a few reasons we know this and some tips to address it.

We routinely see cyber incidents, big and small, arise from employee behaviour. Sometimes, they are intentional acts of a rogue employee. Often, employees are ...

In the latest class action decision involving the Insurance Corporation of British Columbia (“ICBC”), the British Columbia Supreme Court (“BCSC”) found ICBC vicariously liable for a rogue employee’s privacy breaches (Ari v. Insurance Corporation of British Columbia, 2022 BCSC 1475 (“Ari”)). This surprising decision has important implications for ...

It was probably a surprise to many who read James McLeod’s article in June 2020, that Tim Hortons’ app collected detailed location information.  Ironically, the journalist learned of the personal information the app collected about him from Tim Horton’s response to his access request.  Despite only providing the app permission to use the location functionality of ...

On November 25, 2021, amendments to B.C.’s Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165 (“FOIPPA”) came into force through Bill 22-2021, with a few more anticipated within the coming months (by the end of next year).  FOIPPA applies to records in the custody or control of “public bodies”, such as government ministries ...

The Federal Court was asked to decide this question on a reference^[1] in the course of an investigation by the Federal Privacy Commissioner. The big issue in the investigation is whether the Commissioner has the authority to order Google to de-index, or remove links, from searches for an individual’s name. This has become known as the “right to be forgotten.” In this ...