M. Imtiaz Karamat is an IP Osgoode Alumnus and Associate Lawyer at Deeth Williams Wall LLP. This article was originally posted on  on November 16, 2022.

On October 28, 2022, the Office of the Privacy Commissioner of Canada (the OPC)  that data protection authorities around the world endorsed resolutions on facial recognition technology (FRT) and cybersecurity at the 44th Global Privacy Assembly (GPA) in Istanbul, Türkiye.

The GPA is an international forum where data protection and privacy authorities from more than 130 countries meet to discuss privacy matters of interest and coordinate efforts on an international scale.  The theme of the public portion of the event was, “A matter of balance – Privacy in the era of rapid technological advancement”.

During the conference, the GPA members adopted a resolution on the use of , which outlined a series of principles and expectations that they would promote to external stakeholders, assess the real-world application therein, and report back on. These principles require an organization to do the following:

1. Lawful basis:  have a lawful basis for collecting and using biometrics;
2. Reasonableness, necessity and proportionality: demonstrate the reasonableness, necessity, and proportionality of their use of FRT;
3. Protection of human rights: assess and protect against unlawful interference with privacy and other human rights;
4. Transparency: ensure that the use of FRT is transparent to affected individuals and groups;
5. Accountability: include clear and effective accountability mechanisms for the use of FRT; and
6. Data protection principles: ensure that FRT is used in a way that respects all data protection principles.

The GPA also saw the adoption of a  for international cooperation in improving cybersecurity regulation and understanding the harms that results from cyber incidents. As part of this resolution, the endorsing GPA members would take steps to understand the responsibilities of data protection authorities regarding cybersecurity, and explore possibilities for international cooperation amongst members to avoid duplication in investigations and other regulatory activities.

The post 44th Global Privacy Assembly Leads To Resolutions On Facial Recognition Technology And Cybersecurity appeared first on IPOsgoode.

M. Imtiaz Karamat is an IP Osgoode Alumnus and Associate Lawyer at Deeth Williams Wall LLP. This article was originally posted on  on October 19, 2022.

On September 29, 2022, the Office of the Privacy Commissioner of Canada (the OPC) published the results of its  into the 2018 data breach involving Marriott International, Inc. (Marriott), finding many of the hotel giant’s privacy controls inadequate and recommending remedial steps to prevent future breaches.

Marriott announced that it experienced a data breach involving the unauthorized access of a Starwood Hotels (Starwood) database on November 30, 2018, as previously reported by the E-TIPS® Newsletter . Starwood is a separate hospitality company that was acquired by Marriott in 2016, with the unauthorized access reportedly starting before the acquisition (i.e., spanning from 2014 to 2018). The threat actor reportedly obtained access to personal information contained in up to 12.8 million records where the country-of-residence information was listed as Canada. These records included information on guest profiles and contact details, guest reservations, passport details, and encrypted payment card information.

The incident prompted the OPC to launch an investigation into Marriott’s primary operating company for Canadian hotels, Luxury Hotels International of Canada, ULC. During the investigation, the OPC considered the following key issues:

1. �����ڱ𲵳ܲ������.��The OPC reviewed whether there were proper information security safeguards in place to protect personal information. It found several deficiencies in its investigation, including with respect to access controls, anti-virus software, logging and monitoring, and information storage. The OPC found that these deficiencies represented a failure to implement proper protection measures and were a contravention of Principle 4.7 of the Personal Information Protection and Electronic Documents Act��(�ʱ��ʷ��ٴ�).
2. Accountability. Following the acquisition of Starwood, Marriott was accountable for implementing policies to properly protect personal information. The OPC found that despite undergoing a post-acquisition assessment of Starwood’s systems and making certain improvements, Marriott failed to adequately perform ongoing security assessments in contravention of Principle 4.1.4 of PIPEDA.
3. Information Retention. The OPC determined whether the compromised information was held for an appropriate period of time and found that certain personal information was retained for longer periods than necessary in violation of Principle 4.5 of PIPEDA.
4. Notification and Mitigation. Given that the OPC considered the compromised information as presenting an ongoing risk of harm for those affected, it reviewed whether appropriate notification and mitigation measures were used in response to the breach. Marriott conducted both direct notification for those individuals in which it had a valid email address and indirect notification for the remaining individuals (e.g. issuing press releases and providing breach information on a dedicated website). Additionally, Marriott implemented various mitigation measures, such as offering one year of free web monitoring to affected individuals, establishing a dedicated call centre, implementing a process for individuals to verify whether a passport number was involved in the breach, and notifying credit card networks of the incident. Although the OPC would have preferred the web monitoring protection to be for a longer time period, it ultimately found the above notification and mitigation measures to be adequate.

In concluding its report, the OPC acknowledged the remedial steps carried out by Marriott, such as the decommissioning of the Starwood database in December 2018. It also recommended implementing further action to ensure compliance, including having Marriott (i) retain an independent assessor to review any enhancements it has made to its systems; and (ii) review its organizational and governance measures as it relates to selected privacy practices. With both recommendations, the OPC requested that Marriott submit reports detailing their findings and proposed timelines for addressing any action items arising from the reviews.

The post Office Of The Privacy Commissioner Of Canada Publishes Results Of Investigation Into Marriott Data Breach Of 2018 appeared first on IPOsgoode.

M. Imtiaz Karamat is an IP Osgoode Alumnus and Associate Lawyer at Deeth Williams Wall LLP. This article was originally posted on  on August 24, 2022.

On August 11, 2022, the Office of the Privacy Commissioner of Canada (OPC) published a  on its survey of Canadian businesses regarding privacy related-issues (the Survey). This is the first survey of businesses published by the OPC since the beginning of the COVID-19 global pandemic – allowing for comparisons to be made with the pre-pandemic landscape.

The OPC commissions a survey every two years with the last survey conducted in 2019. The Survey findings are used by the OPC to provide privacy guidance to the public and improve outreach efforts with businesses. The Survey was conducted over telephone between January 12 – February 18, 2022 and involved representatives from 751 companies across Canada.

The Survey highlights several key findings on how Canadian businesses currently view privacy compliance. For example, the Survey found that businesses are well aware of their responsibilities under privacy laws with 86% of survey respondents indicating that their company is at least moderately aware of their privacy-related responsibilities, and 74% stating that their company has taken steps to ensure compliance with Canada’s privacy laws. The remaining key findings compared the privacy practices of companies in 2022 with their pre-pandemic counterparts:

1. Privacy Policy: Although the Survey found that 59% of companies have a privacy policy in place, this is less than in 2019 when 65% of surveyed companies reported having such a policy.
2. Privacy Practices: A large portion of surveyed businesses have implemented key privacy practices, such as designating a privacy officer (57%), developing internal privacy policies (51%), and having procedures in place for responding to customer requests for access to their personal information (51%). However, more businesses reported having implemented these measures before the pandemic with 62% having privacy officers, 55% having internal polices, and 60% having procedures for customer access requests in 2019.
3. Data Breaches: The Survey found that 28% of businesses are concerned with potential data breaches, which is a drop in response from 37% in 2019.

In interpreting the results, it is noted that the context of the business landscape during the data collection process may have affected the findings. The Survey was conducted at the height of the fifth wave of the pandemic after almost two years of pandemic-related restrictions. Businesses’ preoccupation with pandemic-related issues may have meant that “privacy responsibilities might not be top-of-mind” for those surveyed, who may have had a limited recall of their businesses’ privacy practices or not prioritized privacy as high amidst sweeping pandemic-related operational changes. This may have explained the reported decline in compliance between the years.

The post The Office Of The Privacy Commissioner Publishes Survey Report Of Canadian Businesses On Privacy Matters appeared first on IPOsgoode.

M. Imtiaz Karamat is an IP Osgoode Alumnus and Associate Lawyer at Deeth Williams Wall LLP. This article was originally posted on  on August 10, 2022.

On July 14, 2022, the Office of the Privacy Commissioner of Canada (OPC) provided its  in response to a consultation launched by the Canada Border Services Agency (CBSA) on proposed Regulations for the Examination of Documents Stored on Personal Digital Devices (the Regulations).

The Regulations relate to An Act to amend the Customs Act and the Preclearance Act, 2016, which strengthens safeguards around the examination of personal digital devices by CBSA officers and other border officials. The Regulations are meant to come into force as soon as possible following Royal Assent of Bill S-7 and would prescribe legally-binding controls for CBSA officers’ examination of personal digital devices. The CBSA opened the Regulations for  in early April, with submissions due by July 15, 2022.

In its submission, the OPC notes that the Regulations, as currently drafted, address some of its concerns for border officers examining personal devices, such as (i) specifying the types of information that must be recorded by examining officers; and (ii) requiring officers to take “necessary steps” to ensure only documents stored on the device are accessible during examination. The OPC recommends that the Regulations be further enhanced to build on these elements and add other features that are not addressed in the current proposal, including the following:

1. Note-Taking Requirements: The Regulations already require examining officers to record certain information when examining personal digital devices and the OPC proposes to build on this by requiring officers to note (A) if the officer changes their rationale for examining the device during the investigation; (B) the reason(s) why a particular document was examined; (C) any relevant communication between the officer and traveler; and (D) whether the search was resultant or not, and further steps taken after making this determination.
2. Disabling Network Connectivity: The OPC proposes that the Regulations should expressly impose technical limitations to ensure the scope of the examination is limited to locally stored documents, such as requiring the activation of “airplane mode”, deactivating any WiFi connection, and ensuring the device is not sharing a connection with another device through Bluetooth or otherwise.
3. Password Collection and Retention: The OPC considers passwords to be sensitive personal information when paired with other identifiers or matched with the device it unlocks. Therefore, it recommends that the Regulations add express controls around password collection, such as not retaining passwords when an examination is non-resultant.
4. Solicitor-Client Privilege. The OPC recommends that the Regulations be amended to include the CBSA’s current policy requirements for dealing with solicitor-client privilege and other types of sensitive information of this nature.

The post Office Of The Privacy Commissioner Of Canada Responds To Proposed Regulations For Examining Personal Digital Devices At Canadian Borders appeared first on IPOsgoode.

M. Imtiaz Karamat is an IP Osgoode Alumnus and Associate Lawyer at Deeth Williams Wall LLP. This article was originally posted on  on July 13, 2022.

On June 27, 2022, the Office of the Privacy Commissioner of Canada, along with fellow members of the Global Privacy Assembly’s International Enforcement Cooperation Working Group (IEWG), released guidance documents to help �����Ի��� protect against credential stuffing attacks.

Credential stuffing attacks exploit the tendency of users to reuse their usernames and passwords across multiple platforms. Threat actors use username and password information that was leaked in past data breaches to access other online accounts belonging to the users. These attacks may result in financial or reputational harm for individuals, and cyberbreaches for organizations despite a robust cyber security infrastructure. In its guidance, the IEWG states that hundreds of millions of credential stuffing attacks occur each day and credential stuffing has become a global threat to personal data.

To assist individuals in defending against credential stuffing attacks, the IEWG advises, among other things, that users should:

• not reuse their passwords across multiple accounts;
• consider implementing multi-factor authentication (MFA) where possible;
• immediately change the passwords for any compromised accounts and for any other accounts protected by the same or similar passwords; and
• routinely check account information for unusual activity or unauthorized transactions.

For organizations, the IEWG discusses (i) implementing password systems and policies that fortify the creation and management process for account passwords; (ii) making MFA an essential security measure in one’s organization; and (iii) using alternatives to traditional accounts setups, such as guest accounts, single sign-on systems, and secondary passwords.

Although these guidelines may not represent legal obligations across all IEWG member jurisdictions, the IEWG intends to raise awareness of the threat of credential stuffing and assist the general public, along with private organizations, in fortifying their personal information practices.

The post International Data Protection And Privacy Regulators Release Guidance On Credential Stuffing Attacks appeared first on IPOsgoode.