Gone are days of unregulated and untethered data gathering. With the rolling out of the California Consumer Privacy Act, Canadian businesses are now finding themselves navigating a sea awash with a patchwork of extraterritorial legislation. The laws are sometimes inconsistent, often vague, and certainly confusing. It has therefore become critical that companies understand their obligations under each of these major regimes, and to delineate the nuanced details between them. Failure to do so may result is severe fines.
In light of this, I have created a quick reference guide for companies looking to better understand their legal obligations under GDPR, CCPA, and PIPEPA.
|
Issue |
PIPEDA |
GDPR |
CCPA |
|
Does each law apply to my business? |
PIPEDA applies to private sector organizations that collect, use, or disclosure personal information during the course of commercial activity. Notably, this applies to small businesses, and some non profits and charities that may be considered as conducting “commercial activity”. |
Applies to processing of personal data by all organizations (Canadian ones too) that are established in the EU, regardless of where data processing occurs. Equally, to organizations that control or processes data with regard to the offering of goods or services, or monitoring the behaviour of EU residents for advertising. |
For-profit companies engaging consumers and households in California. The for-profit companies must have at least $25 million in annual revenue must comply with the law. And companies of any size that have personal data on at least 50,000 people or that collect more than half of their revenues from the sale of personal data. |
|
Who is protected by the legislation? |
A natural person. Does not have to be a citizen, or a resident of a specific province. |
Natural persons resident in the EU, or EU citizens. |
Consumers resident in California, if they are natural persons. |
|
Are employees protected? |
Generally, not. |
Generally, yes. |
Limited application, however this may change. |
|
What kind of information is protected? |
Personal information may be factual, subjective, recorded or not, about an identifiable individual. This could include employee files, loan records, or blood type. |
Personal information may be factual, subjective, recorded or not, about an identifiable individual. This could include employee files, loan records, or blood type. |
Personal information that could identify a consumer or household. |
|
In what ways is information safeguarded? |
Information must be protected in accordance its sensitivity, and in light of developing risks. |
Taking into account current day technologies, risks, and severities, appropriate technical and organisational measures. |
No explicit requirements, however, expect to take appropriate measures. |
|
Notification requirements in event of a breach |
In the event that a real risk of significant harm is posed to the individual(RROSH test) as soon as feasible. |
Where possible, within 72 hours, unless of an unlikely risk to the rights and freedoms of natural persons. |
There are different requirements based on the nature of the businesses. Generally breach individuals must be notified very quickly. |
|
Potential Penalties |
Up to 100,000 Canadian Dollars. |
Up to 20,000,000 euro, or up to 4% of annual worldwide turnover of the preceding financial year. |
$100 to $750 per consumer per incident, or actual damages, whichever is greater. |
As this chart demonstrates, there are several differences between PIPEDA, GDPR and CCPA. Some differences are slight, while others are more obvious. In any case, businesses need not only be aware of their privacy obligations but also take proactive measures to ensure compliance. This means working hand in hand with your IT team to understand where your servers are, what kind of information your business is processing, and what kind of security measures are put in place. It also means making sure your business is working together with competent legal counsel that understands the peculiarities of each law.