Mitacs designed the BSI program for students to find employment this summer and to help participating partner organizations to restore or modify their business operations in response to the COVID-19 pandemic. This is the first year that Mitacs will run this program. Our students will be able to further their legal knowledge beyond the classroom through practical work on real world projects.

Here is some more information about each project:

3D Bridge Patenting and Commercialization Research

has developed a secure digital medication platform through which health practitioners and other authorized care providers can connect with patients remotely. The device will help to ensure that the medication is properly administered to patients, specifically the elderly, patients with comorbidities, and those who take addictive or high-cost medication. Krystel Ametepeh, 1L student and IP Innovation Clinic Fellow, will work under the supervision of Karima Bawa, CEO and in-house lawyer of 3D Bridge, to provide legal research services in intellectual property, health and privacy law and to address the legal requirements associated with commercialization amidst this product’s pre-commercial rollout.

Innovative Educational and Marketing Tools for Prospective IP Rights Owners (Bereskin & Parr)

(B&P) has struggled to market their services and educate clients without their usual in-person events. With funding from Mitacs, B&P will hire Bonnie Hassanzadeh, 2L student and IP Innovation Clinic Fellow, to create educational and marketing tools for various purposes, including training for new staff and educating prospective and existing clients. Under the supervision of B&P Partner Reshika Dhir, Bonnie will also research marketing strategies about tailoring these materials to various clientele and determine the most effective media to convey the relevant information. Some of these materials will be available for use by our IP Innovation Clinic.

Interaxon Scaling Project

is a Toronto-based company that helps customers to build rewarding meditation and sleep practices to lead healthier and happier lives. As the COVID-19 pandemic has increased their need to address mental health concerns, Interaxon is looking to increase the commercialization of its products and services. The funding will allow Androu Waheeb, 1L student and IP Innovation Clinic Fellow, to work alongside Naseem Bawa, General Counsel at Interaxon, in developing licensing arrangements for the company’s relevant IP and seeking FDA approval to make Interaxon’s devices more accessible to users.

We are very grateful to Mitacs for approving IP Osgoode's proposals in this inaugural year of their Business Strategy Internship program. We would also like to thank our supervisors at 3D Bridge, Bereskin & Parr, and Interaxon for working hard on such short notice to make space for our students and put our proposals together. We look forward to seeing how our students grow and what they accomplish with our partner organizations.

The post 3 IP Innovation Clinic Fellows to Receive Mitacs Business Strategy Internships appeared first on IPOsgoode.

Canada’s Increased Reliance on Technology in the Pandemic

The necessity for social distancing during the pandemic has made Canadians more reliant on technology for social, occupational, and healthcare purposes. Instead of meeting in-person, friends and family plan virtual meetups through videoconferencing services and other online platforms. Technology is regularly used by employees working-from-home to fulfill their responsibilities without entering the workplace. It is also useful for students, who can pursue e-learning from the safety of their homes. Our healthcare framework has even shifted from visiting the doctor’s office for medical concerns to using telemedicine platforms to communicate with healthcare practitioners.

Although we have upgraded our lifestyle to incorporate technology in everyday interactions, Canada’s privacy laws have not been updated to fit our data-driven society. Prior to the pandemic, the (OPC) issued several statements urging the federal government to reform its privacy legislation to combat risks associated with our antiquated legal framework. However, little has been done in response to these statements. With Canadians growing more digitally dependent during the pandemic, the gaps in Canada’s privacy infrastructure are becoming more prominent. 

The Risks Associated with Antiquated Laws

In the OPC’s recent to Parliament on the , it highlights key legal gaps associated with the use of commercial platform services. Under our current legislation, commercial enterprises may be able to access sensitive information communicated through online platforms. For example, e-learning platforms can capture information regarding students’ learning disabilities and other behavioural issues. Commercial platforms involved in telemedicine services can also access doctor-patient confidential communication. The OPC argues that these gaps, along with other issues, must be remedied by new legislation that guarantees safety when using essential systems.

The OPC advocates for federal legislative reform to maximize the benefits of technology and minimize associated privacy risks. Among the potential areas of reform, the OPC asks the federal government to define privacy as a human right and use this as a starting point to guide new legislation for data-driven technologies. It also requests the federal government to consider empowering the OPC with enforcement mechanisms to make binding orders and impose administrative penalties for non-compliance with the law.

A Sign of Progress

With the recent tabling of , the federal government may have finally provided a meaningful response to the OPC’s call for legislative reform. Bill C-11 presents the first major step in reforming Canada’s privacy regime and will introduce two new statutes: the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act. These statutes will replace the provisions of PIPEDA that deal with Canadian private sector privacy laws. Among the proposed changes included in Bill C-11, the OPC will be given the ability to make binding orders and recommend administrative monetary penalties of up to 5% of global revenue for companies that do not comply with the orders.

In the OPC’s on November 19, 2020, it noted that Bill C-11 features several improvements to Canada’s current privacy legislation. It praised such advancements like the proposed restructuring of PIPEDA and the addition of order-making powers to the OPC’s list of law enforcement tools. However, it also raised several questions regarding the Bill’s effectiveness in protecting privacy in Canada’s evolving digital society. The OPC plans to further assess the adequacy of Bill C-11 before presenting its views to the parliamentary committee that will study the Bill.

Although it may not be on the OPC’s preferred timeline, the gears of legislative reform are finally turning for Canada’s privacy law regime.

Written by Imtiaz Karamat, Osgoode Alumni and Student-at-Law at Deeth Williams Wall LLP.

The post Reforming Canada’s Privacy Legislation: Does it Take a Pandemic? appeared first on IPOsgoode.

The Supreme Court of Canada is revisiting the issue of whether a privacy commissioner can force disclosure of documents where solicitor-client privilege is asserted.

In 2008, the Supreme Court considered a privacy commissioner’s powers under Canada’s federal private sector legislation and concluded (in Canada (Privacy Commissioner) v. Blood Tribe Department of Health, ) that the federal privacy commissioner could not compel the production of documents over which privilege is asserted . This time around, the court is examining the privacy commissioner’s powers under provincial privacy legislation, which has language that differs from that found in the federal privacy legislation.

On Oct. 29, 2015, Canada’s top court in University of Calgary v JR, .  In that decision, the Alberta Court of Appeal reversed the lower court’s order that documents be produced to the Privacy Commissioner by the university notwithstanding that the university asserted privilege over them. That decision was detailed in McCarthy Tétrault’s Canadian Appeals Monitor .

Background

JR had sued the University for wrongful dismissal and other causes of action. In the course of the litigation, JR made an access to information request under section 7 of the province’s  , R.S.A. 2000, c. F-25 (“FOIPPA”). The University disclosed some, but not all, of the records, withholding records it asserted were subject to solicitor-client privilege. Following unsuccessful mediation, the Alberta Privacy Commissioner commenced a formal inquiry through an appointed delegate into whether the University was exempt from producing the outstanding documents. The Commissioner’s delegate ordered production of certain records so the Commissioner could determine the propriety of the University’s claim that those records were subject to solicitor-client privilege. The delegate’s decision was then judicially reviewed.

Central to the consideration at both levels of court was the statutory interpretation of section 56(3) of FOIPPA, which states:

Despite any other enactment or any privilege of the law of evidence, a public body must produce to the Commissioner within 10 days any record or a copy of any record required under subsection … (2).

The Alberta Court of Queen’s Bench found that the plain meaning of the provision gave the Commissioner the power to compel the records. However, the Court of Appeal applied the Supreme Court’s reasoning in Blood Tribe to determine the Commissioner or her delegate cannot order a public body to produce records over which it has asserted solicitor-client privilege. The Supreme Court will now consider the issue.

The post SCC to Consider Provincial Privacy Commissioner Powers to Compel Production of Privileged Documents appeared first on IPOsgoode.

On June 10, 2014, the Italian Data protection Authority (Garante per la protezione dei dati personali – “DPA”) presented its . In its 17^th annual edition of the Report, the Italian watchdog sets out the status of the implementation of privacy laws and indicates the operation prospects that are required to move towards genuine and effective personal data protection.

1.���������������������������������� Highlights of the Annual Report 2013

The main DPA’s activities in 2013 concerned the following topics.

Internet and the role of large providers. Particular importance goes out to work done by the DPA, also in cooperation with other European authorities, to ensure greater transparency for users in connection with the processing of their personal data via the internet. In this respect, the DPA issued guidelines to protect privacy on smartphones and tablets and recently a resolution on consent for the use of cookies.

Global supervision in connection to the Datagate. Datagate stands for the revealed collecting of personal data of citizens by USA’s National Security Agency (NSA). The DPA raised concerns about espionage performed by the NSA and therefore sent a letter to the Italian Prime Minister, requesting him to support the adoption of the draft reform of the EU legal framework for data protection.

Transparency of the online public administration and safeguards for citizens. The DPA guidelines to make sure that transparency would not be in conflict with the right to privacy and data protection. For example, a dissemination of information on health and economically or socially disadvantaged beneficiaries of public allowances was prevented.

Problems caused by cyber bullying on social networks. On the occasion of the 2013 European Privacy Day, the DPA published a video on its website containing tips for knowledgeable use of social networks. Also a letter was sent to the Italian Ministry of Education to bring the growing problem of cyber bullying to his attention.

Confidentiality of taxpayers. In-depth prior checks were performed on the processing of data performed by the Italian Revenue Agency for purposes of the so-called “Redditometro” (i.e., an income meter tool). The DPA set forth various measures to be implemented, in order to address the many criticalities that were found. These comments related to, among the others, the quality and accuracy of the data used by the Italian Revenue Agency, the estimated expenses incurred by each taxpayer depending on multifarious life-style components, as well as the information to be provided to the taxpayers.

Mobile payments. The DPA launched a public consultation on the processing of personal data performed in connection with payments through the use of smartphones and tablets and, more broadly, through remote mobile payment services (the DPA has recently a resolution on such matter which takes into account the outcome of the public consultation).

Use of biometric data. Significant actions were taken to regulate the use of the biometric signature in banks and the use of fingerprints in the workplace. The DPA found that the use of biometrics in order to check attendance of teachers and administrative staff in several schools was disproportionate, also in accordance with the principles set out by the Article 29 Data Protection Working Party’s on developments in biometric technologies.

Protection of minors in the media and on the internet. The use of webcams in a nursery school was banned in order to protect children’s privacy, the unfettered development of their personality, unrestrained relationships with their teachers and freedom of teaching.

Protection of data used for justice purposes. Measures and arrangements were made to stimulate the security of any personal data that is being collected and used as part of interception activities, carried out by the Telecommunications Interception Centres (“Centri Intercettazioni Telecomunicazioni”), which are attached to every prosecuting office in Italy, as well as to police offices tasked with performing interceptions for judicial authorities.

Video surveillance. Based on spot-checks, the DPA discovered several instances of unlawful processing of employees’ and customers’ data performed by department stores using video surveillance. However, a longer retention period for video surveillance images collected in some building yards and storage areas set up in Pompeii was approved with the objective of preventing mafia-related activities. Furthermore, the DPA required health care districts that had installed video surveillance equipment in the  restrooms of their facilities for ruling out drug addiction cases to take measures and precautions such as to protect the privacy of any individual whose urine sample was being taken.

Unsolicited promotional calls. Inspections and injunctions against IT companies specialized in database services were carried out to counteract unregulated telemarketing and unsolicited marketing. Hefty fines were to be paid since these companies had failed to comply with previous orders. Moreover, automated pre-recorded calls to costumers for debt collection reasons were banned. Other developments related to telemarking (or customer care) activities concerned call centers located in third countries without adequate data protection levels compared to EU standards.  Measures such as the obligation to provide information and notify the DPA in advance about the call centers relied upon, enables the DPA to assess the transfer of personal data outside the EU.

Marketing and spam. Guidelines were adopted on marketing and for countering spam, with special emphasis on the new frontiers of spamming such as social spam (via social network sites) or spam based on the viral (or targeted) marketing. A video tutorial and was made available on the DPA’s website (named “Spam: how you can defend yourself”).

Consent for direct marketing. The DPA adopted a general resolution providing clarifications on the consent requirement in case of processing of personal data for direct marketing purposes. In particular, the DPA made clear that a data controller obtaining a data subject’s consent for direct marketing purposes through automated mechanisms may also process this data according to traditional/non-automated mechanisms (e.g., by post or operator-assisted calls), unless the data subject objects, also in part, to this processing, provided that other requirements set forth by the resolution are met.

Consumer rights. Two banks were allowed to equip their financial promoters with tablets that could perform an analysis of the signature of any customer entering into financial agreements in electronic format. However, the companies involved in enabling and managing both systems were required to take special measures to protect the data they collected. Additionally, measures were created to provide bank customers the option to undersign such agreements through conventional mechanisms as well.

Data retention of telephone traffic data. With the help of the tax police, the DPA performed inspections on telephone companies and internet service providers to verify compliance with the law provisions on internet and telephone traffic data retention. Sanctions in case of non-compliance with previous orders by the DPA were imposed.

Data breach notification. The DPA adopted a resolution for the notification of personal data breach providing guidance on who is required to fulfill the relevant obligations, what measures could ensure minimum common security standards, the timeline and content of the notification.

2.���������������������������������� A few Figures

Over 606 decisions were adopted by the DPA in 2013 (almost 38% more compared to 2012).

The number of on-the-spot inspections has increased by 4% compared to 2012, for a total of 411. The inspections concerned, in particular, call centers and unsolicited telemarketing; mobile payment services; profiling; data breaches; the tax revenue database; consumer credit; credit bureaus; the information system of Italy’s social security agency (INPS).

Interestingly, also the number of the breaches of the Italian data protection law registered an increase, with 850 breach found by the DPA compared to 580 in 2012 (i.e., 47% more). 56% of the breaches concerned the failure to provide adequate information to data subjects. Other breaches involved processing without data subjects’ consent (179 cases); failure to adopt security measures (24 cases); breach of telemarketing rules (19 cases); failure to notify processing operations to the DPA (12 cases); etc.

The fines levied on account of administrative sanctions amounted to over 4 million Euros.

In 71 cases the DPA informed criminal authorities in particular relating to the failure to adopt security measures to protect personal data.

The post The Italian Data Protection Authority’s Annual Report 2013 – Big Data, Transparency and Surveillance appeared first on IPOsgoode.