On Friday, October 16, 2015, the Article 29 Working Party (“WP29”) released a on the decision of the Court of Justice of the European Union (“CJEU”) in the case , the landmark decision which invalidated the decision of the European Commission underpinning the Safe Harbour framework by which personal information was permitted to move from the EU to the United States.

Status of Model Contract Clauses and Binding Corporate Rules

The WP29 stated that it was still considering the Schrems decision and acknowledged the uncertainty that the decision had caused, emphasizing that “data protection authorities (“DPAs”) consider that it is absolutely essential to have a robust, collective and common position on the implementation of the judgment.”

During the WP29’s evaluation period, it suggests that certain similar mechanisms for rendering lawful a transfer of data from the EU to the United States remain valid. In particular, WP29 advises that during its evaluation period, “data protection authorities consider that Standard Contractual Clauses and Binding Corporate Rules can still be used”. Accordingly, while certain data protection commissioners have doubted the validity of these mechanisms, it appears that the majority of commissioners will accept them as legitimate at least for a transitional period. WP29 goes on to note, however, that this will not prevent DPAs from investigating individual cases.

Transfers Considered Unlawful – Enforcement by January 1, 2016

The WP29 also unequivocally stated its view that “it is clear that transfers from the European Union to the United States can no longer be framed on the basis of the European Commission adequacy decision 2000/520/EC (the so-called “Safe Harbour decision”).” It then goes on to say that (emphasis added) “transfers that are still taking place under the Safe Harbour decision after the CJEU judgment are unlawful.”

Businesses will have a short timeline in which to bring themselves into compliance. The WP 29 has set a 3-month deadline for the EU and United States to conclude negotiations and implement a new safe harbour regime. It has warned that “[i]f by the end of January 2016, no appropriate solution is found with U.S. authorities and depending on the assessment of the transfer tools by the Working Party, EU data protection authorities are committed to take all necessary and appropriate actions, which may include coordinated enforcement actions.”

Other Points in the WP29 Statement

In WP29’s view, the “the question of massive and indiscriminate surveillance is a key element of the Court’s analysis” in Schrems and warned that such surveillance is “is incompatible with the EU legal framework” and warned that the transfer of personal information to third countries “where the powers of state authorities to access information go beyond what is necessary in a democratic society will not be considered as safe destinations for transfers.”

This implies that any future adequacy decisions from DPAs will undertake a broad analysis of the third country’s domestic laws and international commitments. In this regard, there is a risk that Canada’s PIPEDA will be called into question in light of this country’s relationship (formal and otherwise) with the United States and Canada’s recent data legislation (in particular Bill C-51, introduced by the Canadian federal government and affording Canadian law enforcement officials greater access to data). It is an open question as to whether this constellation of factors could push Canada into the realm of “inadequate” safeguards insofar as the EU is concerned.

Likewise, there remains a risk that other bases for sending data from the EU to the United States will be threatened by this interpretation of Schrems. In particular, in a number of circumstances, it is unclear whether an importer of data in the United States can make the strong warranties required by the model contract clauses or the binding corporate rules, if similar guarantees were deemed inadequate under the now-invalidated Safe Harbour regime.

Businesses will want to pay close attention to the ongoing Safe Harbour negotiations between the EU and the United States, and in the interim, seriously consider rerouting data flows, evaluate the risks and benefits of model contract clauses and binding corporate rules, and re-evaluate their collection and transfer of personal information where possible.

© McCarthy Tétrault LLP

is Counsel in McCarthy Tétrault’s National Technology Group. is an IP Osgoode Advisory Board member and a senior partner with McCarthy Tétrault in the Toronto office. He is the former Co-Chair of the firm’s Technology Law Group and was the head of the firm’s Internet and Electronic Commerce Group.�� is a partner in McCarthy Tétrault’s Intellectual Property Group and a member of the Privacy, Technology, Franchise & Distribution, and Appellate Groups. is the national leader of McCarthy Tétrault’s Information Technology Law Group and co-leader of the Firm’s national Cybersecurity, Privacy and Data Protection Group.

The post Data Transfers from EU to US “unlawful”; EU Signals Enforcement Actions Possible After January, 2016 appeared first on IPOsgoode.

In a digitized world, it can be all too easy for unauthorized employees to access confidential information in the workplace, as recent at the Saskatchewan Cancer Agency and some have shown. Employers should be prepared to take appropriate disciplinary action against employees who snoop into personal information. In some instances, termination of employment may be appropriate. To minimize liability for wrongful dismissal claims, employers should take careful steps to prevent snooping in the first place and be ready to investigate and discipline employees appropriately if an incident occurs.

Privacy Commissioner: Consider Firing Employees with Prying Eyes

Employers will welcome the comments of Saskatchewan Privacy Commissioner Ron Kruzeniski, who recently against snooping workers, after two employees at the Saskatchewan Cancer Agency were disciplined for prying into the health records of 48 people. Health information should only be accessed by staff caring for patients, and even then, only on a need-to-know basis. The agency learned of the breaches in May and conducted an investigation. The employees were asked why they had looked at the records, but no explanations were forthcoming.

“In extreme cases, I think the firing option should be considered” when an employee pokes their nose where it doesn’t belong, Kruzeniski said. He noted, however, that the “circumstances of each case are also very relevant”. For example, unintentional access may occur when names are mis-typed.

An Ounce of Prevention

Cyber-snooping should be taken seriously, and termination of employment may indeed be appropriate in serious cases. To minimize liability for wrongful dismissal claims, employers should take careful steps to prevent snooping in the first place and be ready to investigate and discipline employees appropriately if an incident occurs. By making it clear that snooping will not be tolerated, an employer may both decrease the incidence of snooping and strengthen their case for appropriate employee discipline if the rules are broken.

Consider taking the following steps:

1. Set the boundaries. Create workplace policies and rules that clearly explain the circumstances in which private or sensitive information may be accessed, and by which employees. Provide training, including refreshers at appropriate intervals, to ensure that employees know how to follow the rules.
2. Build practical barriers. Don’t make it easy to access private records: consider deploying password protection, minimal access or a system that records each time sensitive data is accessed and by whom – or a combination of all three.
3. Explain the consequences. Courts will be less likely to deem discipline, including termination of employment, to be excessive if employees are clearly put on notice of potential consequences before they decide to snoop. Policies should include a clear statement of the disciplinary action that will be taken against rule-breakers.
4. Get it in writing. If the policy is properly incorporated into the employment agreement, it may be possible to discipline or terminate an employee for breaching the policy.
5. Stick to your guns. Turning a blind eye to “minor” snooping may be fatal to an employer’s case for discipline, especially termination for just cause, if behaviour escalates. Be sure to apply policies consistently and fairly.
6. Investigate fairly. Jumping to conclusions will increase potential liability for wrongful dismissal, defamation and other potential claims. Ensure that employees have an opportunity to explain their actions.
7. Discipline proportionately. Termination of employment may be appropriate in certain circumstances but should not be done precipitously. Employers may also consider ending employment of non-union employees without cause (as long as the termination is not connected to a ground protected under human rights legislation) by providing notice or pay in lieu of notice as required under the terms of employment.

Snooping can occur for reasons ranging from the sinister to the mundane, including garden-variety curiosity or boredom. Regardless of the employee’s motivation, employers should be ready to deal with snoops fairly and decisively. This is particularly true now, as recent amendments to Canada’s privacy legislation (which we wrote about ) have introduced a requirement to document breaches of security safeguards, mandatory notification of breaches and the potential for significant fines.

© McCarthy Tétrault LLP

is an associate in the Labour & Employment Group at McCarthy Tétrault in Vancouver.

The post How to Discipline Cyber-Snooping Employees appeared first on IPOsgoode.

On June 30, 2015, the FFIEC released its cybersecurity assessment tool designed to assist U.S. financial institutions and regulatory examiners identify inherent cybersecurity risks and determine preparedness level of financial institutions.�� The cybersecurity assessment tool and other resources can be found .

Background

The FFIEC, which is composed of the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, the Consumer Financial Protection Bureau, the National Credit Union Administration and the State Liaison Committee, formed the Cybersecurity and Critical Infrastructure Working Group in 2013 to assess cyber risk and increase awareness among U.S. financial institutions. In 2014, the FFIEC ran a pilot examination program where it assessed the preparedness of over 500 financial institutions. The assessment tool is partly the result of that study.

General Observations

The FFIEC notes cyberattacks have become more common. New platforms, such as cloud and social media, and new technologies, such as mobile devices and applications, are creating new cyberattack opportunities. Attacks are evolving as more information becomes readily available online, allowing attackers to tailor attacks based on the online behavior of their targets.

The release of the Cybersecurity Assessment Tool demonstrates that regulators are becoming increasingly concerned not only about the level of readiness of financial institutions, but also about the capability of financial institutions’ senior management and boards to respond to cyberattacks. As concern over cybersecurity grows, additional pressure is being placed on senior management and the board to ensure the institution is implementing appropriate risk management and governance practices to ensure the right information is communicated to the right people at all times.

The assessment tool is structured as a two-part process. The first part consists of an assessment of the institution’s inherent risk profile according to its type, volume and complexity of technology and connection types; delivery channels; online mobile products and services; organizational characteristics and external threats, without consideration for any mitigating controls already in place.

The second part consists of an assessment of the institution’s cybersecurity maturity in five different risk areas or domains: management and oversight; threat intelligence and collaboration; cybersecurity controls; external dependency management; cyber incident management and resilience. Each domain includes assessment factors, components and declarative statements that enable institutions to identify practices, process and controls in place across five maturity levels: baseline, evolving, intermediate, advanced and innovative.

The assessment is not designed to identify an institution’s overall cybersecurity maturity level. Rather, the tool can be used to understand whether the institution’s risk management practices and controls are aligned with its inherent risk profile, or whether more needs to be done to achieve the desired level of preparedness. As the institution’s inherent risk profile rises so should its maturity level. The preparedness level should be evaluated periodically, in particular when the institution plans to introduce new products or services or modify its business operations. As the FFIEC states “The assessment [tool] provides a repeatable and measurable process for institutions to measure their cybersecurity preparedness over time.”

In Canada, the Office of the Superintendent of Financial Institutions (“OSFI”) has previously issued in 2013 a very detailed . Similarly to the FFIEC assessment tool, the OSFI guidance provides categories for self-assessment in respect of cyber security practices, each of which is divided into different criteria, that cover multiple operational areas of an institutions beyond information technology. Unlike the FFIEC’s assessment tool, the OSFI guidelines are structured as a single-part assessment of six different risk areas, allow institutions to consider mitigating processes and practices already in place, and do not advocate for information sharing among financial institutions. Both tools provide institutions with repeatable steps that can be used to regularly evaluate their existing processes and resources and to determine whether there are any gaps should be addressed to reach the desired level of preparedness in the event of a cyberattack.

© McCarthy Tétrault LLP

is a partner in��McCarthy Tétrault's Financial Services Group in Toronto.�� is an associate in McCarthy Tétrault's Business Law Group in Toronto.

The post U.S. Federal Financial Institutions Examination Council (FFIEC) Releases Cybersecurity Assessment Tool appeared first on IPOsgoode.

The Digital Privacy Act (Bill S-4) passed into law yesterday, introducing (among other things) significant fines and mandatory breach notification (not yet in force) into the Personal Information Protection and Electronic Documents Act (PIPEDA). Organizations which handle personal information in the course of their commercial activities will want to undertake a review of their privacy policies and security safeguards. In light of the new power to levy significant monetary penalties, boards of directors may want to review their organization’s allocation of risk around these issues.

All new measures under the Digital Privacy Act are now in force, except for the data breach requirements (see discussion below).

The Digital Privacy Act introduces some provisions that will improve the operation of PIPEDA (for instance, introducing targeted exceptions to the consent principle, and expanding the scope of “business contact information” that will not be treated as “personal information”). However, there are four areas that will be of significant concern to organizations: consent, mandatory breach notification, penalties and confidentiality.

Consent

The Act introduces a “sliding scale” of consent that could render existing consents null. The new section 6.1 states (emphasis added):

For the purposes of clause 4.3 of Schedule 1, the consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting.

The government’s press release indicates that clear, simple language will be necessary to obtain valid consents from “vulnerable” Canadians, particularly children, to ensure they fully understand the potential consequences of providing their personal information online.

Previously, there was a “one size fits all” form of consent. Provided the consent was informed, and the purpose of collecting the personal information was clearly stated, that was sufficient. The new sliding scale of consent will cause difficulty for organizations.

The amended language appears to require organizations to assess the sophistication of the users of its websites, products, and services and determine whether such persons understand what they are reading and agreeing to. For an organization with a website that has millions of visitors across multiple demographics, this may be expensive and ultimately, unworkable. For instance, a clothing retailer may have an online catalogue of kids’ and teens’ clothes – is the target demographic kids and teens? Or their parents? Would an organization have to “gate” their webpage with a question about age that, once answered, directs that person to one of a variety of privacy policies? Similar questions will arise for mass-market apps that are attractive to all kinds of audiences.

Mandatory Notification

The Act introduces a new set of obligations with respect to breaches of security safeguards or a failure to establish those safeguards. These will not be in force until the government crafts implementing regulations following a consultation with stakeholders and the Office of the Privacy Commissioner. No timeline has been provided for the implementing of any regulations.

Once these provisions come into force, organizations will be required to report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual. Such report must be made “as soon as feasible after the organization determines that the breach has occurred”.

Organizations will also be required to notify a potentially affected individual of such breach, using a similar threshold.

The “as soon as feasible” requirement is likely to be challenging for organizations in the throes of a data breach, where facts are moving targets and it takes weeks (sometimes months) to understand what has happened. Organizations will be reluctant to provide anything too specific for fear of litigation risk down the road, and may in fact be required to issue multiple notices as an investigation evolves, leading to consumer confusion and “breach fatigue”.

Notice is required where there is a “real risk of significant harm” to an individual. The term “significant harm” is defined to include, among other things, “bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property”.

Further, an organization encountering a breach will have additional reporting obligations to other organizations and government institutions if the breached organization believes the other organizations may be able to reduce their risk of harm as a result.

Penalties

The Act introduces liability for knowingly violating the notification requirements. An organization may be liable for fines up to $100,000 per violation. It is unclear at this time whether a “violation” will include a single incident. (e.g. a single failure to notify all individuals) or each incident (e.g. each failure to notify each individual).

Faced with the risk of this kind of liability, organizations will likely be inclined to over-report, once again leading to “breach fatigue” in consumers.

Confidentiality

Under the previous regime, while the Commissioner had the power to “name and shame” wrongdoers, the Commissioner was (with few exceptions) required to keep information that was provided to it confidential. The new Act now provides the Commissioner with the right to make public any information that comes to his or her knowledge in the performance or exercise of any of his or her duties or powers as well as information in security breach notifications to the Commissioner. (s. 20)

This is likely to make organizations much less willing to make a full and frank disclosure to the Commissioner. In addition, organizations dealing with the Commissioner will now have to be concerned about ensuring their trade secrets and confidential information are adequately protected (potentially through sealing orders or similar mechanisms) as well as ensuring that, by providing information to the Commissioner, they are not in violation of their agreements with third parties or requests made by law enforcement.

Improvements to PIPEDA

(a) New Exemptions to Consent Requirements

The government used the Digital Privacy Act to introduce a number of sorely needed exemptions to consent requirements under PIPEDA. Of note, consent will not be required to:

• use personal information contained in a witness statement that is necessary to assess, process or settle an insurance claim
• use personal information produced by an employee in the course of their employment, business or profession
• disclose personal information to a government institution if the disclosing organization has reasonable grounds to believe that the information relates to a contravention of the laws of Canada, a province or a foreign jurisdiction
• disclose personal information made to another organization and is reasonable for the purposes of investigating a breach of an agreement or a contravention of the laws of Canada, or for the purposes of detecting or suppressing fraud or of preventing fraud
• use or disclose necessary personal information in association with a prospective business transaction, so long as the information is safeguarded and the information is returned or destroyed if the transaction does not proceed

The final provision is particularly welcome in transactional contexts where the vendor has not obtained the consents to share personal information for due diligence purposes in a deal. While courts have occasionally issued orders to permit such disclosures, this has always been a cumbersome and uncertain process for parties to a transaction.

(b) Business Contact Information

The Digital Privacy Act modernizes the “business contact” carve-out from the definition of personal information. It expands it by exempting any contact information that is used for the purpose of communicating or facilitating communication with an individual in relation to their employment, business or profession. This amendment clarifies that a business e-mail address is not covered by PIPEDA so long as it is used for the appropriate purpose of contacting an individual in a work context.

© McCarthy Tétrault LLP

is Counsel in McCarthy Tétrault’s National Technology Group.�� is the national leader of McCarthy Tétrault’s Information Technology Law Group and co-leader of the Firm’s national Cybersecurity, Privacy and Data Protection Group.���� is a partner in McCarthy Tétrault’s Intellectual Property Group and a member of the Privacy, Technology, Franchise & Distribution, and Appellate Groups.�� is an IP Osgoode Advisory Board member and a senior partner with McCarthy Tétrault in the Toronto office. He is the former Co-Chair of the firm’s Technology Law Group and was the head of the firm’s Internet and Electronic Commerce Group.

The post Businesses Should Re-evaluate Approach to Privacy with Passage of Digital Privacy Act appeared first on IPOsgoode.