On November 25, 2024, Ontario's Bill 194, also known as the Strengthening Cyber Security and Building Trust in the Public Sector Act, reached royal assent. The passing of this Bill marks a significant milestone in Ontario's efforts to enhance digital security and trust within the public sector.

The wave of new and updated U.S. state privacy laws is propelling the country towards stronger data protection standards as of January 2025. Evolving state laws are beginning to align with more seasoned privacy regulations of California and other jurisdictions worldwide, creating a unified and robust framework for data privacy.

The Office of the Privacy Commissioner (OPC) and the Global Privacy Enforcement Network (GPEN) recently embarked on a sweep focusing on “Deceptive Design Patterns” (DDPs, also known as “Dark Patterns”) in websites and mobile apps, hunting for manipulative and deceptive designs that undermine users’ privacy.

Google’s plans to follow suit with other big browsers like Safari and Firefox and remove third-party cookies (TPCs) from Chrome has come to a crashing stop. The decision to move forward with keeping TPCs on their web browser is the culmination of many years of back-and-forth discussion on Google’s end (since the year 2020), however, they have ultimately decided to simply enhance their privacy settings without losing an advertising penny from their large pockets. Their solution – the Privacy Sandbox.

As a non-profit, you will likely collect and have access to highly sensitive data, be it from members, supported individuals, minors, volunteers or donors – you are privy to quite a lot. You may be exempt from several onerous pieces of legislation however non-profit organizations are not automatically exempt from PIPEDA. The Office of the Privacy Commissioner of Canada (OPC) has said that “Whether an organization is a non-profit business for purposes of taxation is not determinative of whether its collection, use or disclosure of personal information is carried out in the course of commercial activity”. So is it a ”maybe?”. Over the years there have been several cases in Ontario trying to determine this question.

At Bamboo we’re constantly aware of the push and pull nature between privacy and security, and often it comes to the fore in processes such as incident response or considerations around data lakes and operational data. In the last few weeks though, we’ve seen a great deal of discussion around Data Leak Prevention (DLP) and endpoint protection, and the clash it has against employee privacy – particularly when Bring Your Own Device (BYOD) is involved.

The article discusses the implications of someone filing a privacy complaint with the Office of the Privacy Commissioner of Canada (OPC) and the motivation of naming and shaming companies. It highlights that even if a complaint seems frivolous, it can lead to thorough investigations by the OPC, potentially uncovering compliance gaps within a company's privacy program. The article emphasizes the importance of proactive preparation for businesses, including maintaining updated policies, designating a Privacy Officer, and viewing every decision through the lens of potential regulatory scrutiny. It warns that regardless of the company's size or industry, a single complaint can have significant financial, operational, and reputational consequences, stressing the necessity for vigilance in addressing privacy concerns in the digital age.

In recent years, Canada has experienced a concerning surge in shoplifting incidents, a trend potentially exacerbated by economic factors such as inflation. As the guardians of a retailer's assets, loss prevention personnel find themselves on the frontline in addressing this growing challenge. However, in the pursuit of securing business interests, it is imperative to recognize the delicate dance between protecting assets and upholding privacy rights.

As an immigrant to Canada, I have seen the process and the documentation required to get here. My entire life condensed into a folder to be submitted to a consultant, who will in turn validate everything, and then submit it all to the IRCC (Immigration, Refugees and Citizenship Canada). This translates to a lot of deeply personal information put into the trust of a third-party, and this article goes into how quickly a phishing attack on any business can put sensitive information at risk.

In a world where data breaches and privacy concerns are constantly in the headlines, it’s more crucial than ever for businesses to prioritize and navigate both privacy and security. While these concepts are often treated as separate entities, tackling them together can yield significant benefits for organizations.

The privacy and security functions, respectively, often have tunnel vision and move in different directions causing the business to spin rather than move forward fast. It is time for privacy and security to form an alliance. When privacy and security cross-pollinate to form Governance, Privacy, and Security (GPS), they are better able to protect the business, protect data, and protect individuals.

Call centres are often the first point of contact between customers and businesses. Over the past few years, with advances in technology, including AI, call centres are collecting more personal information than before and using it in novel ways. This article explores how call centres may violate privacy and what they can do to reduce their risk of non-compliance.

Collecting geolocation information can be useful to your business, however, if not done properly, not only will you be non-compliant with privacy regulations, get fined, and find your company in a class-action lawsuit, but you will be classified as that “creepy stalker” that nobody wants to associate with. Read up on the latest cases involving geolocation data.

Consumers have succumbed to the lack of privacy they have, and have come to terms that they must give up their information to participate in society and remain relevant. They know their information is ‘out there’ and they are not getting it back. They know that short of living in a cave, this way of life will not change. Privacy is dead. A reckoning is coming in which consumers will search for companies that are responsible with consumer information. They are searching for companies they can trust. Only those companies that are proactive in re-imagining privacy will remain relevant, profitable, and future-ready for a reckoning that is coming.

Determining the lawful basis for processing personal data can, at times, be confusing as the six lawful bases outlined in the GDPR can be interpreted (or manipulated) to make it fit for purpose. You can no longer avoid seeking consent to process personal data by simply including it in a contract.

As the fiscal year comes to an end, spending your entire privacy budget will ensure privacy has a voice at the table and the privacy function will have sufficient resources next year. The typical ‘if you don’t use it, you lose it’ situation. Don’t let it happen.

Canada’s new federal privacy regime, CPPA, to effectively replace PIPEDA. How small and medium businesses can prepare for this overhaul.

Investigating Privacy and Cybersecurity Risks with Open Banking