GETTING STARTED

with Privacy in Canada

Maria Koslunova, CIPP/C, CIPP/US, CIPM, PwC

International Association of Privacy Professionals

 Many employees, especially at medium-sized firms, get approached by their superiors asking
them to wear “different hats.” Lately, a lot of people have been trying privacy hats on for size.
Although this may not necessarily be a problem for those of us wishing to acquire new skills, it
could pose challenges for others. Particularly for individuals with limited privacy knowledge, they
may not know where and/or how to start figuring out what privacy is and how it impacts their
organization.

Developing and managing an organization’s it is important to start classifying all personal

privacy program is a continuous journey within information into high risk, sensitive, internal,
an ever-changing landscape. Regardless of the and/or public categories. High risk personal
size of the organization, it is very important for information generally requires a greater
the tasked individual to address the following level of protection, while lower risk personal
key areas at the start: information, possibly labeled “internal,” requires
proportionately less. Employing a proper
• What personal information do personal information classification scheme is
we collect? crucial, as it will allow an organization to be
efficient with its financial resources by focusing
• What legal/regulatory/industry more protection efforts on its high risk personal
standards apply to us? information.

• What existing privacy mechanisms It is also important to identify where the

do we have in place? organization collects the personal information
from. Specifically, is the personal information
• How do we improve? collected directly from the individual(s)? Was
personal information collected directly from
By taking the time to address these items, an third parties? Has individual consent been
individual can develop a holistic view of what obtained for collection, use and disclosure of the
an organization is currently doing and where personal information?
the struggles are. These actions make it possible
for the organization to mitigate any privacy It is also important to identify where the
compliance risks and serve as a foundation to individuals are located in order to adhere to any
build the privacy program for sustainable privacy legal requirements. For example, the EU’s General
risk management over time. Data Protection Regulation places specific
requirements on organizations processing
1. What information do we collect? personal information of individuals within the
EU. These requirements apply regardless of
This question is very important in the initial where the data controllers are located in the
stages of developing a privacy program. By not world.
being sure of what personal information is held
and the purposes for which it is being used, an 2. What legal/regulatory/industry standards
organization is unable to ensure that all personal apply to us?
information is being properly protected and used
in a legally compliant way. Organizations should start by reviewing
an industry standard such as the Generally
By completing a personal information inventory Accepted Privacy Principles (GAPP). The GAPP
and identifying what information is collected helps to address the privacy requirements for the
and why, an organization is able to determine personal information lifecycle, including, but not
what protections need to be put in place. Once limited to notice, consent, accountability, use,
a personal information inventory is complete, collection, retention, and disposal.

International Association of Privacy Professionals

 In addition, it helps to determine the jurisdiction c. Newfoundland and Labrador’s
and sector where the organization is operating. Personal Health Information Act
Specifically in Canada, personal information
protection is governed by numerous laws and IV. Additional regulations and best practices
regulations, which can be classified into the include:
following categories:
a. The Canadian Anti-Spam Legislation
I. Federal legislation: (CASL) — Considered the toughest
anti-spam law in the world. The law
a. Privacy Act: Covers the personal places strict requirements on the:
information-handling practices of
federal government departments • Sending of any electronic message
and agencies. (e.g., email, text message, social
media message) that involves some
b. Personal Information Protection form of commercial content.
and Electronic Documents Act
(PIPEDA): Sets out the ground rules • Installing computer programs
for how private-sector organizations (e.g., applications) onto another
collect, use, and disclose personal user’s device in the course of a
information in the course of commercial activity.
commercial activities across Canada
Some provinces have privacy b. Payment Card Industry Personal
legislation that has been deemed information Security Standard
“substantially similar” to PIPEDA, (PCI DSS) — A proprietary
which means that provincial legislation information security standard for
is applied instead of PIPEDA. organizations that handle branded
credit cards from the major card
II. Provincial Legislation — Provinces with schemes including Visa, MasterCard,
privacy legislation deemed “substantially American Express, Discover and JCB.
similar to PIPEDA:
Once the applicable legislations are identified
a. Alberta’s Personal Information the organization will be able to identify specific
Protection Act (PIPA) requirements and how to comply to said
requirements.
b. British Columbia’s Personal
Information Protection Act 3. What existing mechanisms do we have in
(PIPA) place to protect the personal information
we collect?
c. Québec’s An Act Respecting the
Protection of Personal Information It is important to conduct an assessment in
in the Private Sector (Quebec order to understand the current state privacy
Privacy Act) practices, including how personal information
flows into and out of business units and systems.
III. Provincial Health Care Privacy Legislation By doing this, an organization is able to identify
what current risks exist in comparison to
a. Ontario’s Personal Health legal, regulatory and industry requirements (as
Information Protection Act identified in question 2).

b. New Brunswick’s Personal Health

Information Privacy and Access Act

International Association of Privacy Professionals

 In most cases this can be done by assessing: regulatory requirements, business objectives and
operational goals. Privacy should be considered
I. Existing policies and procedures, including: in all business activities, with controls being
designed into operations right at the beginning
• External: Public-facing message that of every new activity.
communicates with customers and
other stakeholders what the organization’s Remember that a strong privacy foundation
personal information handling practices should include key components and capabilities,
are. including:

• Internal: These are internal-facing I. Senior management support and

policies that dictate the ways in which commitment to the overall privacy
the organization collects, uses, protects program.
and discloses personal information
collected. II. An accountable individual who is
responsible for the privacy program.
II. The nature of information collected, the
purposes of its collection, how privacy and III. Adequate internal and external policies
security are ensured operationally throughout and procedures that address legal
the life cycle of the information, and what obligations.
mechanisms are in place to provide individual
access to information and respond to IV. Up-to-date training and education for all
complaints and requests. employees and tailored to specific roles.

III. Privacy and security issues arising from V. Suitable security that includes
employee awareness, management support administrative, technical and physical
processes, availability of guidelines and safeguards.
manuals, and mechanisms for communicating
privacy and security practices. VI. Acceptable breach and incident
management response protocols.
IV. Existing mechanisms that are in place in
order to protect personal information from VII. Strategy on disclosing personal
unauthorized access, use and/or disclosure. information to third parties, privacy
provisions within contracts and periodic
4. How do we improve? audits of third parties.

By establishing the current state of maturity VIII. Adequate privacy program monitoring
and risk baseline, the organization is able to and metrics.
envision its future target state based on specific

A privacy program is an ever-evolving process and needs to be continuously updated. Appoint

accountability agents and construct governance structure in line with organization culture and
requirements. Monitor and report on key performance indicators to determine effectiveness of
privacy services. Obtain external assurance and guidance to assist with the organization’s ever-
evolving privacy journey.

DISTINGUISH YOURSELF
With CIPP/C Certification.
[Link]/certify/cippc/

International Association of Privacy Professionals