News

My Appearance to discuss Bill 64 (Quebec privacy law – private sector)

Éloïse Gratton September 22, 2020

Earlier this summer, Quebec’s National Assembly introduced Bill 64, An Act to modernize legislative provisions as regards the protection of personal information, which proposes to overhaul Quebec’s privacy laws, including those applicable to private-sector organizations. Among the various changes being considered, the bill would significantly increase monetary penalties, introduce new enforcement mechanisms, impose new data […] Read more

News

Réflexions sur le projet de loi no 64 (protection de la vie privée dans le secteur privé au Québec)

Éloïse Gratton September 22, 2020

Je suis ravie d’avoir aujourd’hui témoigné devant la Commission des institutions dans le cadre de leurs Consultations particulières et auditions publiques sur le projet de loi no 64, Loi modernisant des dispositions législatives en matière de protection des renseignements personnels. J’ai soumis, avec certains collègues, un court mémoire dans lequel nous présentons nos observations sur […] Read more

News

Ontario signals the coming of commercial privacy legislation

Éloïse Gratton August 26, 2020

In a move of great significance to organizations doing business in Ontario, the province recently opened a consultation on private sector privacy regulation. The consultation, which runs until October 1, shows a strong commitment to moving forward with legislation that will create new and stringent privacy compliance requirements and potentially establish new employee privacy rights […] Read more

News

Manufacturers of internet of things devices: guidance from the Canadian Privacy Commissioner

Éloïse Gratton August 24, 2020

There has been plenty written about the growth of the internet of things (IoT) market. Arguably, the global pandemic may have even crystallized the benefits of IoT solutions and pushed towards system-wide digitization across industries, communities, cities, and countries. While there is currently no IoT specific legislation in Canada, on August 20, 2020, the Office […] Read more

News

Cloud services – Guidance for managing cybersecurity risks

Éloïse Gratton August 23, 2020

Cloud services make information technology (IT) resources (e.g., networks, servers, software applications and data storage) and related services (e.g., hardware and software maintenance and technical support) available as a utility or consumption-based service. Cloud services enable an organization to outsource its IT requirements to a specialist cloud service provider (a CSP) who can provide required services in […] Read more

News

Alerte COVID : La loi québécoise en matière de protection de renseignements personnels encadre déjà certaines pratiques d’employeurs ou entreprises pouvant être intrusives

Éloïse Gratton August 14, 2020

Alerte COVID est l’application gratuite de notification d’exposition lancée par le gouvernement fédéral le 31 juillet dernier. Cette application qui peut être téléchargée volontairement par les Canadiens permet d’informer les utilisateurs s’ils ont été près d’une personne qui a reçu un diagnostic de COVID-19 et qui utilise également l’application, et les encourage à prendre des […] Read more

News

OPC affirms requirements for transferring personal information across borders for processing

Éloïse Gratton August 14, 2020

On August 4, 2020, the Office of the Privacy Commissioner of Canada (the OPC) issued PIPEDA Report of Findings #2020-001 (the Report), which concluded that a Canadian financial institution (the FI) had complied with its obligations under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) in connection with outsourcing aspects of its fraud claims processing services to […] Read more

News

Canadian exposure notification application is out!

Éloïse Gratton August 5, 2020

COVID Alert was released on July 31st. The app is meant to help us break the cycle of infection by letting people know of possible exposures before any symptoms appear. COVID Alert does not use GPS or track location information. I am delighted to be joining the COVID-19 Exposure Notification App Advisory Council that will […] Read more

News

“Schrems II”: Impacts on agreements involving processing personal data outside the EEA

Éloïse Gratton July 31, 2020

On July 16, 2020, the Court of Justice of the European Union (CJEU) issued its judgment in case C-311/18, Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems (the Schrems II Decision). The judgment invalidates the EU-U.S. Privacy Shield adequacy decision from the European Commission (the Privacy Shield Decision). It also requires EU data exporters relying on the European Commission’s […] Read more