Articles

With the rise in the collection, use and disclosure of personal information and personal health information across organizations, the prevalence of privacy breaches, and the recognition of common law privacy torts in Ontario, organizations increasingly face legal, financial and reputational consequences from personal information handling practices. This article considers how this evolving area of law may inform an organization’s internal risk management program.

David Young summarizes his testimony before the the House of Commons Standing Committee on Access to Information, Privacy and Ethics on its study of PIPEDA. Read on for David's submissions on consent, the PIPEDA enforcement framework, and how PIPEDA aligns with the forthcoming European General Data Protection Regulation.

Canadian Securities Administrators recently published the results of their review of cyber security disclosure and guidance on appropriate disclosure.

The Federal Court of Canada recently affirmed the application of PIPEDA to a foreign-based website operator. While PIPEDA has been applied to foreign companies before, the decision in A.T. v Globe24h.com and Sebastien Radulescu is the most explicit statement on the issue of extraterritorial application to date.

Recent landmark legislative amendments, regulatory activity, and an unprecedented increase in privacy litigation, damage awards, and class action certifications are among the key trends and legal risks in the Canadian cybersecurity environment. In this must-read article, Alex Cameron examines these trends and key developments to watch in the coming year.

In its recent decision in RBC v. Trang, the Supreme Court of Canada provided guidance to financial institutions holding otherwise “highly sensitive” information on how to determine when that information is somewhat less sensitive, such that it can be disclosed.

in December 2016, the Ontario Superior Court of Justice released Patel v. Sheth, the next in a series of cases sprouting from the 2012 recognition of a tort of intrusion upon seclusion. While Patel is deeply planted in a messy matrimonial context the analysis and finding of an invasion of privacy is worth addressing from a business risk perspective as well.

The OBA Privacy and Access to Information section has struck a working group to explore the creation of a LSUC Certified Specialist Program in privacy and access to information law. The executive invites section members to join and participate in the working group.

The first Compliance and Enforcement Decision under Canada’s Anti-Spam Law was issued on October 27, 2016. Among other insights, the decision provides clarification on the "conspicuous publication" ground of implied consent to receive commercial electronic messages and the application of the factors relevant to the quantum of an administrative monetary penalty under CASL.