Law Times - sample

Page 4 March 12, 2018 • Law TiMes www.lawtimesnews.com NEWS NEWS NEWS Cybersecurity threats plague organizations Proposed changes to privacy laws influenced by EU BY JENNIFER BROWN Law Times R ecommendations from a parliamentary com- mittee to strengthen the Personal Informa- tion Protection and Electronic Documents Act and give more power to the federal privacy commissioner are likely being driven by privacy requirements coming into effect in Europe. On Feb. 28, the federal Stand- ing Committee on Access to In- formation, Privacy and Ethics published a report on the Per- sonal Information Protection and Electronic Documents Act. The study of federal pri- vate sector laws recommended stricter legislation and stronger enforcement powers. In particular, it recommends "including in PIPEDA a frame- work for a right to erasure based on the model developed by the European Union (EU) that would, at a minimum, include a right for young people to have information posted online, ei- ther by themselves or through an organization, taken down." Patricia Kosseim, the former general counsel and director general of the Office of the Pri- vacy Commissioner of Canada, says the recommendations are likely connected to the Canadi- an government wanting to keep in line with regulations required by the European General Data Protection Regulation coming into effect May 1. "A lot of the impetus for that is coming from across the ocean in the form of GDPR regula- tions. That is certainly setting the pace and parliamentar- ians are very keen to make sure Canada doesn't fall behind," says Kosseim, who recently joined Osler Hoskin and Harcourt LLP, as counsel to the firm's Privacy and Data Management Practice Group. Kosseim will work with Adam Kardash, chairman of the firm's national Privacy and Data Management Practice. She will co-lead the "next generation" of Osler's AccessPrivacy platform. The GDPR, which affects many Canadian companies that have customers and dealings in Europe, seeks to strengthen and unify data protection for those living in the EU and address the export of personal information outside the EU. The standing committee's report makes 19 recommenda- tions to update PIPEDA and to take other measures to improve the protection of Canadians' privacy in their relation with pri- vate sector organizations. The committee also recom- mends amending PIPEDA to provide the privacy commis- sioner with enforcement pow- ers — such as the power to make orders and impose fines for non- compliance — as well as broad audit powers, including the abil- ity to choose which complaints to investigate. At the federal privacy com- mission, Kosseim provided legal and policy advice on emerging privacy issues, advised Parlia- ment on the privacy implications of legislative bills, led research initiatives on new information technologies and advanced pri- vacy law in major litigation cases before the courts, including the Supreme Court of Canada. Prior to that, she worked at Genome Canada and the Ca- nadian Institutes of Health Re- search. Kosseim says the evolving privacy landscape will continue to be a "major preoccupation" for many organizations both large and small. "I think some of the big pri- vacy challenges that are con- cerning to many general counsel and private sector organizations is the fast and inevitable changes to the legislative landscape. "Canada will be hard placed to align itself with the new GDPR regulations that are due to be fully implemented this May," she says. "Organizations are going to have to stand ready to imple- ment whatever this new genera- tion of privacy laws may usher in, on the one hand, but they also have a wonderful opportunity to help shape that policy agenda with input in the legislative and regulatory process and they will need to supplement that frame- work with practical operational solutions as well." While she says the majority of organizations try to do the right thing, there is a vast span of sophistication. Large-scale sophisticated organizations are not only complying with the law but setting the pace with new data governance processes and building privacy into their tech- nologies as they build them. "I think there are many indus- try leaders, but on the other end of the spectrum, you have many smaller promising startups with great ideas but absolutely no bandwidth to know how to be- gin to design even the most basic compliance programs," she says. Cybersecurity threats also plague organizations of all sizes and are increasing as external threats and actors become even more capable of infiltrating sys- tems, along with internal threats. Cyber-threats can be an "un- witting factor and reason" for non-compliance despite the best efforts of many. She says as long as organiza- tions are taking reasonable ef- forts, they may still be found to be compliant even though their systems may have been breached. "Breach is not synonymous with compliance, but certainly cybersecurity makes it challeng- ing for everybody," she says. "We're just dealing with really complex issues and nobody has answers to those and they have everybody stumped in terms of trying to resolve and find paths forward to take advantage of the great potential and promise of data while respecting people's privacy, and I think that's the challenge for everybody in the next couple of years if not the short- or medium-term hori- zon," she says. Privacy lawyer David Young, who is based in Toronto, says the main controversial focus of the report that will be subject to de- bate going forward concerns the consent rules in PIPEDA. Young says the committee heard a lot of testimony about the current consent rule under PIPEDA, which holds that any use or disclosure of an individu- als' information for commercial purposes must be consented to by the individual. He says some pushed to get rid of or soften the consent model, while others said it should be strengthened. The recommendations sug- gest that "consent remain the core element of the privacy re- gime, but that it be enhanced and clarified by additional means, when possible or neces- sary." Young says the recommenda- tion expresses a commitment to keeping the consent model. "To me, it means yes, the con- sent rule is going to stay," he says. The report also recommends amending PIPEDA to explicitly provide for "opt-in consent" as the default for any use of per- sonal information for secondary purposes. Young says this recommen- dation will be controversial and unlikely to be adopted, as it is unrealistic in today's world. He says the provincial government unsuccessfully tried to pass its own privacy law 15 years go, which included an opt-in con- sent proposal. "It's probably the most out of the mainstream recommenda- tion that's there and I don't think it will be adopted," he says. Young says another recom- mendation that is problematic asks the government to consider amending PIPEDA to clarify "the terms under which personal information can be used to satis- fy legitimate business interests." The federal government is expected to respond to the rec- ommendations outlined in the report within 120 days. Young says the government will not respond with specific amendments at that point, but it might give some indications of what direction it is going to go in. He adds it will likely take the government years to propose an amending bill for PIPEDA as the committee is proposing a major overhaul to the legislation. He says it could take as long as six years to pass legislation address- ing the issues in the recommen- dations. "This still will take time to work through the legislative pro- cess," he says. LT — with files from Alex Robinson Patricia Kosseim says recommendations from a parliamentary committee are likely connected to the Canadian government wanting to keep in line with regulations required by the European General Data Protection Regulation. This still will take time to work through the legislative process. David Young JUDICIAL VACANCY ONTARIO COURT OF JUSTICE SARNIA The Judicial Appointments Advisory Committee advises the Attorney General of Ontario on the appointment of Judges to the Ontario Court of Justice, and invites applications for a judicial position in Sarnia. This appointment involves presiding over criminal law matters and also involves travel within the regional boundaries as assigned by the Regional Senior Justice and/or the Chief Justice. The minimum requirement to apply to be a Judge in the Ontario Court of Justice is ten years completed membership as a barrister and solicitor at the Bar of one of the Provinces or Territories of Canada. All candidates must apply either by submitting 14 copies of the current (July 2017) completed Judicial Candidate Information Form in the first instance or by a short letter (14 copies) if the form has been submitted within the previous 12 months. Should you wish to change any information in your application, you must send in 14 copies of a fully revised Judicial Candidate Information Form. If you wish to apply and need a current Judicial Candidate Information Form, or if you would like further information, please contact: Judicial Appointments Advisory Committee Tel: (416) 326-4060 Fax: (416) 212-7316 Website: www.ontariocourts.ca/ocj/jaac/ All applications, either sent by courier, mail or hand delivery, must be sent to: Judicial Appointments Advisory Committee c/o Ministry of Government Services Mail Delivery 77 Wellesley Street West, Room M2B-88 Macdonald Block, Queen's Park Toronto, Ontario, M7A 1N3 Applications must be on the current prescribed form and must be TYPEWRITTEN or COMPUTER GENERATED and RECEIVED BY 4:30 p.m. on Tuesday, April 3, 2018. CANDIDATES ARE REQUIRED TO PROVIDE 14 COPIES OF THEIR APPLICATION FORM OR LETTER. A Fax copy will be accepted only if 14 copies of the application or letter are sent concurrently by overnight courier. Applications received after this date WILL NOT be considered. The Judiciary of the Ontario Court of Justice should reasonably reflect the diversity of the population it serves. Applications from members of equality-seeking groups are encouraged. Untitled-4 1 2018-03-06 1:26 PM

• Cover