Page 21 - CCCA Magazine Spring 2014

{ COVER } PRIVACY RISK AN IN-HOUSE GUIDE By Pablo Fuchs “It wasn’t even on our radar back then. In my frst month on the job here, our then general counsel came to me and asked, ‘How would you like to be our expert on privacy law?’” says Robert Osborne, general counsel and chief privacy offcer (CPO) with PricewaterhouseCoopers LLP in Toronto, who began working with the global accounting giant nine years ago. “Since then, we have expanded our focus on privacy,” he contin- the federal and provincial legislations are substantially similar, ues. “We have a small [legal] team here of six lawyers, and in ad- each has its own unique set of rules and regulations by which dition to myself, we have another lawyer who is now certifed as companies must abide. a privacy professional, and a third lawyer who’s taking courses Meanwhile, some other provinces, such as Ontario, have and getting up to speed in this area because it affects our busi- no PIPAs, but they do have privacy acts that relate to personal ness on multiple levels.” health information. As well, companies operating in Manitoba Osborne is only one of many corporate counsel across Cana- will soon have to wrap their heads around that province’s pri- da who has been affected by the drastic change in the workplace vacy legislation, the Personal Information Protection and Identity when it relates to privacy-related matters, with these issues hav- Theft Prevention Act, which was passed in the fall of 2013 but is ing gone from an afterthought to top of mind in only a decade. not yet in effect. Thus, navigating this legislative minefeld is no easy task for corporate counsel. COMPLYING WITH LEGISLATION “You have a patchwork of different legislation and you really Although Quebec was the frst jurisdiction in Canada to put need to understand what your obligations are to employees in into force private-sector privacy legislation in 1994, things took those various jurisdictions. So, when you have employees spread off in 2004 with the full implementation of the federal Personal out across the country, you really have to make sure you’re com- Information Protection and Electronic Documents Act (PIPEDA) pliant with all these different layers of legislative requirements and similar provincial legislation — the Personal Information as it pertains to privacy. What we do at Xerox is take the most Protection Act (PIPA) — in British Columbia and Alberta. The stringent provision and make it the standard for all employees federal Privacy Act, which has been in force since 1983, imposed in Canada,” says Daniel Bourque, senior corporate counsel and obligations on federal government departments and agencies CPO with Xerox Canada Ltd. in Toronto. to respect the privacy rights of individuals, but PIPEDA and And if being in tune with the various laws weren’t enough, the PIPAs go far beyond that, extending the protection of per- new and emerging case law is redefning the landscape. In No- sonal information to private-sector organizations. And while vember, the Supreme Court of Canada released a signifcant deci- CANADIAN CORPORATE COUNSEL ASSOCIATION | CCCA-ACCJE.ORG 21