OPC Guidance on Consent applies as of Jan. 1 and CRTC's CASL FAQs have been updated
Important privacy developments as we kick off 2019.
1. The Office of the Privacy Commissioner of Canada's Guidelines for obtaining meaningful consent are now being implemented as of January 1, 2019. The new guidelines were issued in May 2018 by the OPC, jointly with the offices of the Information and Privacy Commissioners in Alberta and British Columbia, and are comprised of seven guiding principles for obtaining meaningful consent. These are:
- Emphasize key elements, namely;
- What personal information is being collected,
- With which parties personal information is being shared,
- For what purposes personal information is collected, used or disclosed, and
- Risk of harm and other consequences;
- Allow individuals to control the level of detail they get and when;
- Provide individuals with clear options to say 'yes' or 'no';
- Be innovative and creative;
- Consider the consumer's perspective;
- Make consent a dynamic and ongoing process; and
- Be accountable: Stand ready to demonstrate compliance.
In particular, businesses will want to pay attention to how the OPC distinguishes between those things an organization "must do" to obtain meaningful consent (legal requirements) and those things an organization "should do" to improve their consent process (best practices).
2. The CRTC's CASL FAQs were recently updated and include new questions and answers on:
- the applicability of CASL to business-to-business messages, to limited-access accounts (such as secure portals on banking websites), and to employment recruitment messages;
- CASL's conspicuous publication exemption from consent; and
- the Commission's investigative powers and enforcement actions that it can take to respond to non-compliance with CASL.
We will be discussing these and other important recent developments at our upcoming monthly privacy teleconference call, which is scheduled for Wednesday, January 23, 2018 from 11:30 am to 12:00 pm Eastern Standard Time.