Executive Summaries Apr 17, 2018

The GDPR is Coming: How to Get Ready

Recently there has been much concern – some justified, some less so – about the coming into force on May 25, 2018 of the General Data Protection Regulation. While the regulation should be taken seriously and organisations brought into compliance with the new law, there is no reason to panic.

Danielle Miller Olofsson has authored this article.

To begin with, the General Data Protection Regulation ("GDPR") is a logical extension of EU Directive 95/46/EC (the "Directive") that already placed limits on the data organisations could collect, the means they used to do so, the time for which they could keep the information, and the jurisdictions to which data could be transferred. Since the Canadian Personal Information Protection and Electronic Document Act ("PIPEDA") was enacted largely in response to the Directive, organisations that are already PIPEDA compliant will invariably have to tighten their practices to comply with the GDPR but they are by no means starting from scratch.

The most demanding elements of the GDPR

Some of the most demanding features of the GDPR for organisations seeking to conduct business in Europe are:

  • Shift in the burden of proof: a suspected breach is not required for a national privacy commission to audit an organisation. The commission can audit at any time and the organisation must prove it is compliant.
  • Security by default: data controllers (those collecting the data) are required to take measures to ensure that, by default, only data necessary for the specific purpose of the processing are in fact processed.
  • Security by design: any information system put in place to collect, use or store data must, at the time of design, be conceived so as to be GDPR compliant.
  • Data subject’s rights: the GDPR provides the data subject (the person whose information is being collected) with many rights, some of which include the right to be completely and accurately informed of the use to which their information will be put and the organisation’s obligation to obtain the data subject’s explicit consent before processing. In addition to the rights to access and rectification, that previously existed in Europe and that exist in Canada, the data subject also has the right to request that information be erased. This "right to be forgotten" is still being debated in Canada and a decision by the Quebec privacy commission suggests that it does not exist in Quebec.
  • Data portability: the data subject has the right to request that all the information that a data controller has collected on them be transmitted to the subject in a structured, commonly used, and machine-readable format so that they can transmit it to another data controller.
  • Joint responsibility for supplier or subcontractor breach: an organisation cannot plead that it did not know that a supplier or subcontractor was not compliant. Nor can it simply rely on a vague letter confirming compliance. Organisations have the obligation to conduct a satisfactory inquiry into their suppliers’ or subcontractors’ compliance even if this means asking for a privacy audit.
  • Penalties: depending on the nature of the breach, an organization may be liable for a variety of penalties reaching up to the higher of 20 million euros or 4% of their total annual worldwide turnover. There are many considerations, however, that will be taken into account in assessing the level of the penalties.

Measures to be taken to comply

In light of the above, the following are some measures that an organisation should take to become compliant:

  • Designate a person in the organisation who will be responsible for data protection and compliance.
  • Conduct a mapping: identify the information collected by your organisation that could trigger the application of the GDPR. Given the broad definition of personal information in the GDPR, it is unlikely that the regulation is not triggered.
  • Develop a data processing register: establish the types of information you collect (HR, client information, supplier information, etc.) and for each type, establish how you collect, use, store and communicate this information.
  • Ensure supplier and subcontractor compliance.
  • Store and process the information in such a way as to respect the data subject’s rights: in the event the data subject requests all their information, it must be easy to locate and communicate. Likewise if organizations receive a take-down request, they must be ready to respond rapidly and compliantly.
  • Conduct an impact study: although not mandatory in all instances, an impact study is highly recommended. This study outlines for each type of information (see 2 above) what impact a breach would cause and how to react. The CNIL (Commission national de l’informatique et des libertés) website has free software that can assist organisations with this task.
  • Develop a data protection policy: this policy should include collecting only necessary data, and limiting access to only those who are required to use it. It should also contain a data retention / destruction plan, a technology charter, a model form of consent, a plan of response to data subjects who chose to exercise any of their rights (rectification, access, erasure, mobility), and an emergency response procedure in the event of a data breach.
  • Establish an employee training program: data protection affects each and every member of an organisation. It is a culture that must be implemented, tested, and refreshed on an ongoing basis.

By way of information, in the event of an audit by the CNIL, the commission will ask for the following documents to ensure an organisation’s compliance:

  • The data processing register
  • The Impact study
  • Contracts with sub-contractors and suppliers
  • Data transfer contracts for data exported outside the EU
  • Data collection disclaimer
  • Model form(s) of consent
  • Proof of consent
  • Processes in place to respond to the data subject’s exercise of their rights
  • Internal security measures to prevent a breach as well as a communication plan once a breach has occurred.

While the GRDP spells a new era of data protection for organisations conducting business with Europe, and while the compliance burden it places on these organisations is onerous, it is by no means unsurmountable. Many public and private bodies exist to help to bring organisations into compliance. So while it is probably too late to put in place a fully compliant program between now and May 25, it is by no means too late to begin!

BCF would be happy to assist you in navigating the GDPR and implementing a compliant data protection program. Please contact a member of the Privacy, Data Protection and Cyber-Crypto Security team for more information.

You would also like

Propriété intellectuelle

BCF Professionals Recognized Among the World’s Leading IP Experts

IAM Patent 1000: Seven partners recognized among the most prestigious patent professionals

BCF is recognized in the 2025 edition of the Chambers Global directory

Data-Privacy

Bill 82: One Step Closer to a National Digital Identity (and Modifications to Other Provisions!)

Entrepreneurship forum

Entrepreneurship Forum: Vision 2025

BCF Stands Out in Legal 500 Canada

Athlete

Protecting Privacy in Sports – Don’t Wait to be Caught Flat-Footed!

data-protection

Obligation to Report Information Security Incidents: The Autorité des Marchés Financiers Catches the Wave and Publishes a New Regulation

Right to Data Portability: Is your Organization Ready?

Tech Forum 360

Tech 360 Forum: Growth and Inflection Points

Open source code

Modifiable Licensing in AI: A New Era for Open Source

Article Keezio Group - Propriété Intellectuelle

Unfounded Allegations of Online Intellectual Property Infringement: A Potential Backfire!

IAM Patent 1000: Six Partners Rank Among the Most Prestigious Patent Professionals

Prospera: Québec’s Economic Barometer

Canada's Best Managed Companies: BCF Recognized for 17th Consecutive Year

paul et misha

BCF Strengthens its Expertise in Artificial Intelligence

Three Partners Ranked Among the Top Trademark Professionals in the World Trademark Review 1000

new-partners-2024

BCF Has Appointed Three New Partners

Who’s Who Legal : 5 BCF Professionals Stand Out

BCF extends its Partnership with the Canadian Association of Black Lawyers to a Third Year

Demystifying Privacy Impact Assessments (PIAs)

The Data Processing Agreement: An Essential Resource to Implement

camera-on-a-wall

The Incident Response Plan: the Cornerstone of Effective Crisis Management

forum-privacy-en

Strategic Forum on Enterprise Data Protection

IP_Stars

Managing IP: 5 of our professionals recognized as IP stars

Chambers Canada Ranking: Five of our Lawyers Recognized

Photo of Julie Doré

Julie Doré Takes Over Management of The BCF Business Law Firm

Influencers and Counterfeiting: Risks and Consequences

hands-signing-documents

Free Trade Agreements: Their Potential Impact on Your Trademark Protection Strategy Abroad

Prospera – Quebec Economic Barometer

IAM Patent 1000: Five Partners Ranked Among the Most Prestigious Patent Professionals

Julien Tricart, Member of the Meritas Sports Law Group

Pride Month: Let’s Create an Inclusive Future

BIMI (Brand Indicators for Message Identification): Registered Trademark Required

NFTs and Terms of Use: They Go Hand in Hand

Canada’s Best Managed Companies: BCF Recognized for 16th Consecutive Year

New Privacy Requirements: Is Your Business Compliant?

Every Woman Counts

Strategic Forum on the Role Played by Businesses in the Fight Against Climate Change

BCF Partners with the Canadian Association of Black Lawyers to Promote Diversity in Québec Law Faculties

BCF's More Inclusive Approach: Improved Parental Leave

Shaun E. Finn Appointed to the Superior Court of Québec

How to Ensure a Business Succession?

Business black folders on table

Adoption of Bill 78 on Transparency Business: Are You Ready?

Strategic Forum on Market Consolidation and Business Succession

BCF Partners with the Clinique Juridique de Saint-Michel to Promote Access to Legal Studies for Young People from Diverse Communities

What Are the Best Practices for Managing Privacy Incidents?

Shaun E. Finn, Co-Author of In the Public Eye: Privacy, Personal Information, and High Stakes Litigation in the Canadian Public Sector

Should Using Personal Information Obtained Without Consent Be Grounds for Class Action Authorization?

Five of our Lawyers Stand out in the 2023 Edition of the Chambers Canada Ranking

Cybersecurity and Privacy in Canada: What You Need to Know About Bill C-27

Is the Loss of Personal Information Sufficient to Justify the Success of a Class Action on the Merits?

Bill C-26: The Federal Government Takes a Closer Look at Cybersecurity and Privacy

Jocelyn Poirier, BCF’s Chief Privacy Officer

Master Classes in Intellectual Property

43 BCF Professionals Stand Out with 78 Nominations in the 2023 Editions of Best Lawyers in Canada and Ones to Watch

Seven New Lawyers Join BCF

Adoption of Bill 96: Be Ready

Pride Month: The Value of Diversity

BCF, the 3rd Largest Law Firm in Québec

Canada’s Best Managed Companies: BCF Recognized for 15th Consecutive Year

BCF Recognized by the Globe and Mail as one of Canada’s top Law Firms

Almost Half of the Canadian Businesses Have Little Knowledge of Intellectual Property: Be in the Other Half!

Chambers Canada 2022: BCF Earned Band 1 Ranking in Québec for Corporate and Commercial Law

IAM Strategy 300: Our Partner Ilya Kalnish Is Recognized As One of the World's Top IP Strategists

Seven New Lawyers Join BCF

Privacy and Data Protection Class Actions: Trends, Challenges and Best Practices

A First in Canada: Privacy Class Action Dismissed on the Merits

escalier

BCF Welcomes Seven New Lawyers

Collaboration in the Time of COVID-19: Legal Considerations for Successful AI and Healthcare Partnerships

Merger between La Capitale and SSQ Insurance results in the creation of Beneva, the largest mutual in Canada

Shaun E. Finn and Danielle Miller Olofsson Publish a Unique Practical Handbook on Privacy and Data-Protection Class Actions

What Are the Implications of the End of EU-U.S. Privacy Shield Framework for Your Business?

Investigation on Tim Hortons’ Application

Québec’s Bill 64 to Amend Data Protection Legislation: A Bill with Teeth?

Does the Use of Thermal Imaging Cameras in Stores Comply with Privacy Laws?

COVID-19: Solutions to Address this Situation

COVID-19: Finally a Toolbox for Developers of Geolocalisation Applications

Tracking the COVID-19 Pandemic with Cellphones

COVID-19: Don’t Forget Data Protection When Designing a Response Strategy

BCF once again ranks as one of Montreal's Top Employers

BCF Names 16 New Partners for Its 25th Anniversary

Joint Controllership or the Risks of using Website Plugins

Are You a Leader or a Follower?Results of the Innovation Survey

Chambers Canada 2020: BCF Recognised in Corporate and Commercial Law

Strategic Forum on Innovation

Different Legislative Approaches to 5G

Innovating to Survive: Are You a Leader or a Follower?

BCF Appointed Canada’s Exclusive Representative to the Unifab College of Experts

Is Your Company Implementing a New Technology System? Remember to Protect Your Data

5G Technology Is Coming: Legal Questions Abound

What About the Name of Your Innovation?

Legal Issues Surrounding the Industrial Revolution 4.0

Where Does Québec Stand in Terms of Privacy Class Actions?

De-fogging the Cloud Act

fenetres

Google and CNIL: a Case of Inappropriately Obtained Consent

Promoting Cannabis on Social Media? Proceed with caution

Best Practices for Québec Companies Receiving European Data

Anonymization? Think Again

The Deep Web and Dark Web Demystified for Businesses

Protection of Personal Data: New Measures Put in Place by the European Union

Is Your Organisation Collecting Too Much Data and Is It Well Protected?

Get the latest thought leadership