What the GDPR Means for Canadian Businesses

With the severity of cyber attacks increasing on what seems like a daily basis, governments are now stepping in to provide guidance and keep the general public both safe and informed.

In Canada, the Digital Privacy Act (DPA), which amends the Personal Information Protection and Electronic Documents Act (PIPEDA), is the federal law that dictates how organizations respond to and report data breaches. However, these are not the only cyber-related laws Canadian businesses have to contend with, as Europe’s data breach regulations can have a sweeping impact on international businesses of all kinds.

In fact, any organization that operates or sells in the European Union (EU) or manages EU-based information could face major fines if they fail to comply with the General Data Protection Regulation (GDPR). As such, it’s crucial for organizations to have a general understanding of the GDPR and how to remain compliant.

What is the GDPR?
The GDPR, which comes into force May 25, 2018, is unique in that it is not simply limited to organizations that have a physical presence in the EU. Regardless of the location of a business, the GDPR applies to businesses that process personal data of EU-based individuals and:

• Offer goods or services to an individual in the EU (even if those goods and services are offered at no charge)
• Monitor the online behaviour of individuals from the EU

Based on these provisions, the GDPR can have a broad effect on organizations, regardless of their size, location or nature of operations. Effectively, those that trade in the EU or hold data of EU-based individuals must comply with the GDPR.

Fines and Compliance Requirements
Understanding the GDPR is important, especially when you consider that failing to comply can result in major fines and penalties—up to €20 million or 4 per cent of a company’s global annual turnover.

With the severity of these fines, just one GDPR violation can financially devastate an organization. That’s why it’s critical that companies understand what’s expected of them when it comes to GDPR compliance.

The following are five key features of the GDPR that businesses should be aware of:

1. Obligations for controllers and processors—The GDPR defines two distinct types of operations in its regulations—controllers and processors. The following are general definitions and standards that apply to these entities:
   1. Controllers—Under the GDPR, any organization that collects, uses or discloses personal information of EU citizens may be considered a controller. Controllers are expected to protect the data of EU citizens and ensure that the processor who processes personal data on their behalf is also complying with GDPR rules. Controllers are also expected to conduct privacy impact assessments for any processing which is likely to result in a high risk and maintain records of all processing activities.
   2. Processors—As mentioned above, processors process data on behalf of controllers. These entities must also implement appropriate safeguards, return or delete data once processing is complete, and notify the controller of any data breaches. Processors cannot subcontract any tasks without a controller’s permission.
2. Consent requirements—Per the GDPR, consent to process data must be given unambiguously by the owner of the data itself. Silence or inactivity does not constitute consent. In instances where an organization processes data for individuals under the age of 16, parental consent is required.
3. Mandatory data breach notifications—Following a data breach, affected individuals must be notified by the controller within 72 hours of the breach’s discovery. However, in instances where the breach could impact the rights and freedoms of affected individuals, the notification must be made without delay. Processors are also obligated to report the breach to the company that collects and/or controls the lost data.
4. Right to erasure—Per the GDPR, controllers are required to erase processed and/or stored personal data in the following situations:
   1. If the data is no longer needed
   2. If an individual objects to processing
   3. If the processing was unlawful
5. Requirement for data protection officers—Under the GDPR, controllers and processors may be required to designate a data protection officer in the following scenarios:
   1. If data processing is carried out by a public authority or body
   2. If core activities involve regular and systematic monitoring of individuals on a large scale
   3. If core activities consist of large-scale processing of certain categories of data (i.e., data related to racial or ethnic origins, criminal convictions or political views)

While the above list outlines a number of the major GDPR considerations, it should not be used as a compliance guide. To review the final version of the regulation, helpful FAQs and summaries of key changes, visit the EU’s official website on the GDPR.

Ensuring Compliance
For organizations new to EU privacy laws, the GDPR can be overwhelming and confusing. Thankfully, Canadian businesses can do the following to ensure they are compliant and avoid potential fines:

• Conduct a readiness assessment. Review the GDPR and determine if it applies to your business. If your organization determines that it’s subject to the GDPR, it’s important to evaluate how much EU data your business processes. Be sure to also examine the potential impact of the GDPR on your operations.
• Identify compliance gaps. During your initial assessment, it’s important to identify any potential compliance gaps. In some cases, you may find that you are able to reduce your GDPR compliance burden by changing the way you store or track EU data.
• Establish oversight. When it comes to GDPR governance, it’s important to take a structured approach. Continually document, model and coordinate potential GDPR issues and remediation strategies.
• Implement a GDPR compliance program. After you’ve established key processes to identify compliance gaps, create a GDPR program to address potential concerns. This program should account for the following:
  • Governance
  • Policy management
  • Data life cycle management
  • Individual rights processing
  • Information security
  • Data breach management
  • Data processor accountability
  • Training and awareness
• Remain prepared. Once your GDPR program is in place, conduct ongoing assessments to ensure continued compliance.

While the GDPR may be similar to PIPEDA and other privacy legislation in Canada, organizations should never assume compliance. Even if your business has well-defined data management practices and privacy policies in place, all organizations must review their current system for GDPR compliance issues and fill in any gaps.

Round Out Your Cyber Risk Management Program
In today’s environment, organizations process massive amounts of personal data every day. This data is a popular target for cyber criminals, and just one breach can result in serious financial losses and reputational damages.

If that weren’t enough, businesses that don’t respond to these incidents in accordance with federal and international privacy laws face hefty fines and penalties. To better protect your organization, it’s important to speak with a qualified insurance broker.

Not only can brokers provide general guidance on any applicable data breach laws, they can also help you round out your risk management programs with custom insurance policies. To learn more, contact the Axis Insurance Group today.

Do you know how to stay compliant in the event of a data breach? Download our Digital Privacy Act Guide for information on the steps you need to know.