{"id":2661,"date":"2024-05-07T15:16:18","date_gmt":"2024-05-07T21:16:18","guid":{"rendered":"https:\/\/processprimer.com\/?p=2661"},"modified":"2026-07-23T17:17:48","modified_gmt":"2026-07-23T23:17:48","slug":"is-your-businesss-privacy-program-ready-for-canada","status":"publish","type":"post","link":"https:\/\/processprimer.com\/blog\/is-your-businesss-privacy-program-ready-for-canada\/","title":{"rendered":"Is Your Business’s Privacy Program Ready For Canada?"},"content":{"rendered":"\n

Did you know that, when and if Bill C-27 passes, that the financial impact for severe infractions goes up by 250x, to a maximum penalty of $25M CAD or 5% of the organization’s revenue, whichever is GREATER?!<\/mark><\/strong><\/p>\n\n\n\n

Did you also know that Canada’s Anti-Spam Legislation (CASL) is amongst the most stringent in the world<\/strong>? The legislation has helped to reduce spam since its inception in 2014 and has caused companies to be more disciplined in managing their electronic marketing campaigns, especially with the threat of penalties and fines of up to $1M for individuals and up to $10M for organizations<\/strong>.<\/mark><\/p>\n\n\n\n

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada’s federal privacy legislation for private-sector organizations engaged in commercial transactions and for employees of FWUBs (federal works, undertakings, or businesses). And although some provinces (British Columbia, Alberta, Quebec) have their own provincial privacy laws that are deemed substantially similar to PIPEDA, PIPEDA still applies when and if a company transmits personal information across provincial or national borders.<\/strong><\/p>\n\n\n\n

\n\n\n\n

So what is “personal information” and what’s all the concern about?<\/h2>\n\n\n\n
\n

“Personal Information” can be defined as information about an identifiable information or information that can be used to identify an individual.<\/strong> So, we’re talking about identifiers such as name, phone number, email address, home address, date of birth, social insurance number, and so forth; not to mention health and biometric data (voiceprint, fingerprint, etc.), banking information, ethnicity and nationality and sexual preference.<\/mark> And, it doesn’t end there, but I think you get the idea.<\/p>\n<\/div>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

Now, more than ever, data is everywhere and it has become really difficult to track all the places we’ve shared personal information and identify who (or what institution) has and is using our information.<\/p>\n\n\n\n

Did you know<\/strong> that over the past ten years, some very recognizable brands – Amazon, CapitalOne, Equifax, Home Depot, Instagram, TikTok, Meta (Facebook), T-Mobile, Uber, and Morgan Stanley (to name a few) – have all been fined over $100M for data breaches or non-compliance with privacy legislation?<\/p>\n\n\n\n

As a business leader, or business owner, do these threats keep you up at night<\/strong>, or do you have a sufficient privacy program in place in your organization so you can sleep peacefully?<\/strong><\/p>\n\n\n\n

In a 2022-2023 survey<\/a>, 93% of Canadians expressed concern regarding their protection of privacy.<\/strong><\/h2>\n\n\n\n

Canadians are equally concerned about identify theft and, rightly so, in this day and age where identify theft can all be done remotely with a mobile phone and an internet connection.<\/p>\n\n\n\n

In response to this, Canadian privacy legislation is becoming more and more strict about what personal information organizations can collect and use.<\/h2>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

Organizations need to identify, in advance, how they intend to use personal information they collect, and notify individuals at or before the time it is collected<\/strong>.<\/p>\n\n\n\n

Organizations also need to identify an individual in their organization who is responsible for designing and implementing practices to comply with privacy legislation<\/mark>. This includes identifying and documenting the<\/strong> following<\/strong>:<\/p>\n\n\n\n

    \n
  • what personal information is being collected (list all fields)<\/li>\n\n\n\n
  • what is the specific use\/purpose for each piece of personal information<\/li>\n\n\n\n
  • how is the organization obtaining consent from the individual to collect, use, or disclose their personal information (verbal\/written, expressed\/implied)<\/li>\n\n\n\n
  • whether or not an individual’s personal information will be disclosed outside of the organization (i.e., to third parties, vendors, partners, cloud-service providers, etc.)<\/li>\n\n\n\n
  • in what jurisdictions is the personal information being stored (which provinces and\/or countries)<\/li>\n\n\n\n
  • at what point in time an individual’s personal information will be disposed of (retention schedule)<\/li>\n\n\n\n
  • how to facilitate an individual’s request to access, update, or delete their personal information <\/li>\n\n\n\n
  • how an individual’s personal information is safeguarded (in both physical and digital forms)<\/li>\n\n\n\n
  • is the personal information being used to automate any decisions about the individual<\/li>\n<\/ul>\n\n\n\n

    Does your company’s privacy program adequately address all of this for customers and employees? If yes, awesome! If not, read on…<\/strong><\/p>\n\n\n

    \n
    \"\"<\/figure>\n<\/div>\n\n\n

    With substantial changes in privacy legislation<\/mark> (example: Quebec’s Bill 64, enacted on September 22, 2021), meaning much more stringent guidelines in favor of a “privacy by default” approach<\/mark>, do you know the requirements for collecting and obtaining consent for the use of personal information? Do you know how and what personal information is being collected and safeguarded? How long are you supposed to retain personal information for, and then how do you dispose of it appropriately? Are you in compliance with Canada’s Anti-Spam Legislation (CASL) when sending Commercial Electronic Messages (CEMs) to mobile phone numbers, email addresses, or instant messaging accounts?<\/p>\n\n\n\n

    \n\n\n\n

    What does this all mean for your<\/span> business?<\/h2>\n\n\n\n

    It means that if you own or lead a private-sector or non-profit organization<\/mark>, BEWARE <\/strong>of the personal information that you are collecting, using, or disclosing, and understand that you have an obligation to comply with privacy and protection of personal information laws. Ignorance, or failure to comply with privacy legislation, coupled with a privacy complaint or a data breach can result in you or your organization receiving hefty fines, experiencing a loss of reputation in the news, unexpected legal efforts, and suddenly being faced with a whole bunch of work to do to develop and implement privacy practices in a hurry.<\/p>\n\n\n\n

    So you got my attention…what am I supposed to do to reduce my risk?<\/h2>\n\n\n\n

    The answer is simple (but I didn’t say “easy”): read on!<\/strong><\/p>\n\n\n\n

      \n
    1. Begin with a quick self-assessment for you to gauge your preparedness for managing privacy within your business.<\/li>\n\n\n\n
    2. Begin taking action with a few tips to help you develop a robust privacy program.<\/li>\n<\/ol>\n\n\n
      \n
      \"\"<\/figure>\n<\/div>\n\n\n
      \n\n\n\n

      Let’s begin by offering you a simple privacy self-assessment for your organization.<\/h2>\n\n\n\n

      If you do business in Canada in the private sector and you’re wondering about your company’s preparedness to comply with privacy legislation, take the following self-assessment<\/mark> (you don’t need to share your answers and we do not ask you for any personal or business information).<\/p>\n\n\n\n