Lexpert Special Editions

14 www.lexpert.ca Feature Personal Information Protection and Electronic Documents Act] is a creature of 2000, and the British Columbia and Alberta equivalents to PIPEDA came into force a few years aer that. So, we're overdue for some reform and some modernization," he says. Quebec had the first privacy laws affecting the private sector in North America, says Morgan. Now, British Columbia is also looking at amending its privacy laws; Ontario updated its Personal Health Information Protection Act in March to implement tougher enforcement measures, and, in October, it completed a public consultation in preparation for further strengthening its privacy protection laws. Business competitiveness e proposed federal legislation represents "a massive change" in monetary sanctions for data breaches that are in line with the European Union's General Data Protection Regulation implemented in May 2018, says Morgan. "We've never ever seen anything like [this] in Canada up until now." e corporate fines that would be imposed for the most serious infractions of digital privacy are signif- icant: five per cent of an organization's gross global revenue in its financial year before the one in which the organization is sentenced, or $25 million, whichever figure is higher. In announcing the legislation, then minister of Innovation, Science and Industry Navdeep Bains said these fines would be the highest among G7 countries. Quebec's Bill 64 would impose even harsher monetary sanctions: up to eight per cent of worldwide revenues for repeat offenders, says Daniel Glover, Morgan's colleague and national co-leader of McCarthy's cyber-data group, from his Toronto office. "ese are fines that are not just going to be in the millions but in the billions of dollars," Glover says, and not all of these fines are attaching to criminal regimes. "Some of them are supported by fairly thin procedural protections for what are potentially immense penalties. . . . "e new legislation is momentous, and it's happening not only federally but in Quebec, Ontario, B.C. I think there's a prospect for a lot of litigation coming out of this, frankly, if the bills remain in their present form, because the stakes are going to be very, very high. Penalties have been mostly focused on parties that don't co-operate . . . as opposed to penalties for violation of a substantive provi- sion of the act." New legislation contemplates changes to cross-border transfers of information, particularly in Quebec, Glover says. e first reading of Bill 64 looks to "equivalence," meaning that information can't be transferred from Ontario to Quebec without deeming Ontario's law to be equivalent to Quebec law; this would apply to other jurisdictions to which Quebec is transferring information — a particularly onerous diligence exercise for a small company. And businesses will be assessing, Glover says, "am I willing to offer business in a juris- diction that carries a four- or eight-per-cent of revenue fine for data breaches?" "Canadian jurisdictions have to consider the potential chill that might be created if the penalty is so high that companies that could do business in those jurisdictions [do so]: Is it worth it? Because we're going from a regime in which there are very few penalties . . . to ones that are stronger even than [the] European Union," he says. "ere is a ques- tion as to whether the market size of Canada is significant enough for those businesses to be comfortable in continuing to offer busi- ness into Canada." Data protection and cybercrime In recent years, data breaches and hacks have become far more common and COVID-19 has only exacerbated the problem, say the privacy and data protection lawyers, as hackers exploit vulnerabilities of a new remote, work-from-home environment. "It's amazing the sophistication resulting from COVID," says Fabiano. Individuals "THERE'S A PROSPECT FOR A LOT OF LITIGATION COMING OUT OF THIS, IF THE BILLS REMAIN IN THEIR PRESENT FORM, BECAUSE THE STAKES [FOR BREACHES] ARE GOING TO BE VERY, VERY HIGH." Daniel Glover MCCARTHY TÉTRAULT LLP says Charles Morgan, national co-leader of McCarthy Tétrault LLP's Cyber Data Group, from the firm's Montreal office. And although the proposed changes are described as "momentous" for business — with some anticipating pushback due to potential fines in the millions or billions of dollars for data breaches — the moderniza- tion is "sorely needed," says Daniel Fabiano, a partner at Fasken Martineau DuMoulin LLP in Toronto. "Quebec privacy law is a creature of the 1990s; it does not speak in the language of today's economy. PIPEDA [the federal

• Cover