The Business Case For Privacy in Canada
This is a guest post from Samir Murji, Founder & Principal Counsel at Muris LPC, as well as an active Good Lawyer on our platform. Samir specializes in corporate law and business negotiation and has gained significant experience in the technology and privacy industries through his practice.
I’m too busy. Why should I care about privacy?
As an entrepreneur, it is extremely important to invest resources from the outset to safeguard your customer’s privacy by developing and maintaining transparent privacy and data security policies and practices. Such an investment will not only help you potentially avoid legal risk and limit your company’s exposure to security attacks when they inevitably occur but will also help strengthen your brand even support customer acquisition.
Your customers are conscious of and increasingly concerned with how their personal information is collected, used, and shared. Safeguarding customer privacy has become much more than a risk mitigation tactic for start-ups and large corporations alike, it’s a strategic opportunity for brand growth and reputation building. The privacy section included in the terms of service hyperlinked in the footer of your website is not enough to demonstrate your company’s commitment to customer privacy; it must be proven by your actions. If you take away only one thing from this article, it should be that respecting your customer’s privacy should be at the forefront of your company’s decision-making process and should be a gated question you asked on every project or development. Your customers will notice and will in turn reward you.
My business is too small for me to worry about this.
The size of your business, current stage of your growth cycle, or number of customers or users you have does not matter when it comes to your privacy obligations. If your company breaches applicable privacy legislation, you will not get any special treatment because you are a start-up. Commercially speaking, you may also risk losing trust among your customers or users which is crucial at early stages of growth.
So what’s the law?
Advancements in technology and the legislation that regulates it are in a constant footrace with technology always a few steps head. As such, privacy regulations are continuously evolving to govern the relationship between companies and consumers and safeguard privacy. The Personal Information Protection and Electronic Documents Act (PIPEDA) is the federal privacy law, regulating how to handle personal information collected by your business. PIPEDA applies to all federally-regulated businesses in Canada (including those incorporated in Ontario), with the exception of British Columbia, Alberta and Quebec, who have their own privacy laws.
Personal Health Information is regulated by a provincial privacy act in each province. In Ontario, the Personal Health Information Protection Act (PHIPA) sets out rules for the collection, use and disclosure of personal health information.
There are also limits to how businesses send commercial electronic messages via email, social media and text to prospective customers or users in Canada. The Canadian Anti-Spam Legislation (CASL) requires that businesses receive explicit consent from individuals to send electronic messages.
If your company is controlling or processing personal information in the European Union or of EU data subjects, the EU’s General Data Protection Regulation (GDPR) applies also. GDPR is aimed at enhancing individuals' control and rights over their personal data and regulating the processing of personal data of EU resident individuals.
In addition to negative publicity, there are substantial legal and financial consequences for violating all applicable privacy legislation which vary depending on the violation.
What is Personal Information that should be safeguarded?
Personal information is essentially any information which relates to your customers or users that could identify them. It includes age, medical records, income, ethnic background, credit card numbers and so forth. Generally, any information not available on a public LinkedIn profile is protected.
With respect to your employees, personal information would include their names, email addresses, home addresses, social insurance numbers, dependents, marital status, and age among other items.
How can I make my business compliant?
Follow these 10 fair information principles from PIPEDA to govern your collection, use, and safeguard of personal information to get your business on the right track:
- Accountability - An organization is responsible for personal information under its control and must appoint someone for its compliance with these principles.
- Identifying Purpose - The purposes for which the personal information is being collected must be identified by the organization before or at the time of collection.
- Consent - The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information
- Limiting collection to a minimal basis - The collection of personal information must be limited to that which is needed for the purposes identified by the organization and be collected by fair and lawful means.
- Limiting use, disclosure, and retention - Unless the individual consents otherwise or it is required by law, personal information can only be used or disclosed for the purposes for which it was collected and only be kept as long as required to serve those purposes.
- Accuracy - Personal information must be as accurate, complete, and up-to-date as possible.
- Safeguards - Personal information must be protected by appropriate security relative to the sensitivity of the information.
- Openness - An organization must make detailed information about its privacy policies and practices publicly available.
- Individuals must be able to access their own personal information - An individual must be informed of the existence, use, and disclosure of their personal information and be given access to that information and have it amended as appropriate upon request.
- Individuals must be able to challenge your compliance to PIPEDA - An individual shall be able to challenge an organization’s compliance with the above principles.
Using these 10 principles, you must create a privacy policy that applies to your specific business and the personal information that you collect. You must do an assessment of your business practices to determine what data points are collected and assess what kinds of controls you need to implement to protect that personal information. Keep in mind that most web platforms and analytics tools collect personal information including IP addresses, geographic target location, cookies, page visits and clicks, names and passwords, among other data points.
What should be in my privacy policy?
Ok so in exchange for all this free information, here’s my not so shameless plug: If you’re still reading this, you likely need a privacy policy so stop reading now and reach out to me or another experienced privacy expert to help you assess your privacy needs and craft a custom privacy policy that is not only compliant but creates transparency for your customers or users and clarity for your staff. This is certainly an area where hiring a trained professional is worth the investment.
The foregoing is for informational purposes only and should in no way be relied upon as legal advice. If you have any further questions about privacy or data, you can schedule an Advice Session tailored to your business needs with Samir here.
