Cover Up the Data that I Must Not See!

2016-06-06

ROBIC,LLPwww.robic.ca
info@robic.com
MONTREAL1001Square-Victoria-BlocE-8thFloor
Montreal,Quebec,CanadaH2Z2B7
Tel.:+1514987-6242Fax:+1514845-7874QUEBEC2828LaurierBoulevard,Tower1,Suite925
Quebec,Quebec,CanadaG1V0B9
Tel.:+1418653-1888Fax.:+1418653-0006

COVERUPTHEDATATHATIMUSTNOTSEE!

PIERRE-MARCGENDRON*
ROBIC,
LLP
L
AWYERS,PATENTANDTRADE-MARKAGENTS

“Thingslikethatoffendoursouls,andfillourminds
withsinfulthoughts.”Tartuffe,III,2(v.860-862)

Mobiletechnologiescompletelyrevolutionizedourlifehabits.Onceatoolallowing
onlysporadicInternetaccess,mobiledevicesnowofferthepossibilitytodojust
aboutanythingonewouldhavedoneonacomputer.Inaseriesoftwo(2)articles,
wewillprovideananalysisoftheissuespertainingtocybersecurityaswellasan
overviewofbestpracticesintermsofcorporategovernancepertainingto
cybersecurity.
Fromacommercialstandpoint,mobiletechnologiesandthecomputerizationof
businessesnowallowforthecollectionofavastarrayofinformationabout
consumers.Thecombinationofallthisdataprovidesveryaccurateprofilesof
consumersinordertopredicttheirbehaviours.Somebusinesseswillnothesitateto
changetheproductsdisplayedontheirwebsite’shomepageorthewordsappearing
ontheirwebsite’sinterfacebasedontheprofilesoftheirusers.

Thisdataisextremelyvaluableforbusinessesand,asaresult,businessesdevelop
andusemoreandmoremethodstocollectandanalyzeit.However,fromalegal
perspective,thisdatamayconstitutepersonalinformationandthusbesubjecttoa
dutyofprotectiononthepartofthebusinessescollectingit.Indeed,theseprofiles
makeforanidealtargetforhackersseekingtostealpersonalinformation.

Nowadays,thequestiontoaskoneselfregardingcyberattacksisnot“willmy
businesssufferanattack?”,butrather“ismybusinesspreparedfortheattacksitwill
face?”Whetheritbeastart-uporamultinationalcompany,nobusinessisimmuneto
acyberattack.Moreover,attackswillcontinuetobeathreatdespitetheeffortsand
techonologyputintotryingtopreventthem.
Atfirst,itmightbetemptingtobelievethatcybersecurityconcernsonlyIT
departments.However,fromalegalstandpoint,theissuesraisedbycybersecurity

©CIPS,2016.*FromROBIC,LLP,amultidisciplinaryfirmofLawyers,andPatentandTrade-markAgents.Published
intheWinter2016(Vol.19,no.2)Newsletterofthefirm.Publication068.201E.

2
areamatterofprivacyprotection.Thisfirstarticleprovidesanoverviewofthemost
importantlawsapplicabletoprivacyprotectionintheprivatesector.

Thecriteriontoestablishifdataconstitutespersonalinformationiswhetherit
pertainstoaspecificindividualandmakesitpossibletoidentifyhimorher.
Accordingtocaselaw,informationwillbeaboutanidentifiableindividualwherethere
isaseriouspossibilitythatanindividualcouldbeidentifiedthroughtheuseofthat
information,aloneorincombinationwithotheravailableinformation.

BoththeParliamentofCanadaandtheNationalAssemblyofQuebechaveadopted
lawspertainingtotheprotectionofpersonalinformation.ForQuebecbusinesses,the
applicablelawisnotnecessarilythatofQuebec.Theprovinciallawappliesonly
wherethecollection,communicationoruseoftheinformationarelimitedtothe
province’sterritory.Assoonasthecollection,disclosureoruseoftheinformation
takesplaceoutsidetheprovince,thefederallawapplies.

Thefederallaw(PersonalInformationProtectionandElectronicDocumentsAct)and
provinciallaw(AnActRespectingtheProtectionofPersonalInformationinthe
PrivateSector)shareessentiallythesameprinciples,althoughtheirimplementation
differsslightly.
Theselawsmakeitmandatoryforabusinesstoobtainindividuals’consentpriorto
collecting,disclosingorusingpersonalinformation.Suchconsentmustbefreeand
informed,sothattheindividualmayreasonablyunderstandhowhisorherpersonal
informationwillbecommunicatedorused.Thecollectionofpersonalinformation
mustalsobelimitedtowhatisnecessaryforthepurposesidentifiedatthetimeof
collection.Thedisclosure,useandretentionofpersonalinformationmustalsobe
limitedtothepurposesforwhichconsentwasobtainedandforaslongasnecessary
fortheaccomplishmentofsuchpurpose.
Businessesalsohavetheobligationtoputappropriatesecuritymeasuresinplace,
takingintoaccountthesensitivenatureofthepersonalinformationcollected.These
measuresmustprotectpersonalinformationagainstlossortheft,aswellas
unauthorizedaccess,disclosure,copying,use,ormodification.Organizationsshall
protectpersonalinformationregardlessoftheformatinwhichitisheld.

Amongotherthings,theamendmentsmadetothefederalstatuteonJune18th,2015
willsooncreateanobligationforbusinessestoreportanybreachintheirsecurity
measurestothePrivacyCommissionerofCanada,aswellastotheindividuals
whosepersonalinformationwascompromisedandtowhomitisreasonableto
believethatthebreachwillcausearealriskofseriousharm.Businesseswillalso
havetheobligationtokeeparecordofallbreachestotheirsecuritymeasures.For
thetimebeing,theseprovisionsarenotyetinforce.

Acyberattackissuretohaveanimpactonyourprofitability.Indeed,intheaftermath
ofanattack,youwillincurseveralexpensesincludingexpensestore-establish

3
operations,restoreyourdataandindemnifyyourclients.However,the
consequencesmaybealotmoredramatic.TheAshleyMadisoncaseisarecent
exampleofthepotentiallydevastatingconsequencesrelatedtoacyberattack,
pursuanttowhichmillionsofindividualssawtheirpersonalinformationrelatedtoan
adultery-promotingwebsiteexposed.Followingthisscandal,thefirm’sCEOwas
forcedtoresignandatleastonesuiciderelatedtothisattackhasbeenreported.

Inthenexteditionofthenewsletter,asecondarticleonthistopicwillshowhowto
applytheseconceptswithinyourbusiness.

ROBIC,ungrouped’avocatsetd’agentsdebrevetsetdemarquesdecommercevouédepuis1892à
laprotectionetàlavalorisationdelapropriétéintellectuelledanstouslesdomaines:brevets,dessins
industrielsetmodèlesutilitaires;marquesdecommerce,marquesdecertificationetappellations
d’origine;droitsd’auteur,propriétélittéraireetartistique,droitsvoisinsetdel’artisteinterprète;
informatique,logicielsetcircuitsintégrés;biotechnologies,pharmaceutiquesetobtentionsvégétales;
secretsdecommerce,know-howetconcurrence;licences,franchisesettransfertsdetechnologies;
commerceélectronique,distributionetdroitdesaffaires;marquage,publicitéetétiquetage;poursuite,
litigeetarbitrage;vérificationdiligenteetaudit.ROBIC,agroupoflawyersandofpatentand
trademarkagentsdedicatedsince1892totheprotectionandthevalorizationofallfieldsofintellectual
property:patents,industrialdesignsandutilitypatents;trademarks,certificationmarksandindications
oforigin;copyrightandentertainmentlaw,artistsandperformers,neighbouringrights;computer,
softwareandintegratedcircuits;biotechnologies,pharmaceuticalsandplantbreeders;tradesecrets,
know-how,competitionandanti-trust;licensing,franchisingandtechnologytransfers;e-commerce,
distributionandbusinesslaw;marketing,publicityandlabelling;prosecutionlitigationandarbitration;
duediligence.

COPYRIGHTER
IDEASLIVEHERE
ILATOUTDEMÊMEFALLUL’INVENTER!
LAMAÎTRISEDESINTANGIBLES
LEGERROBICRICHARD
NOSFENÊTRESGRANDESOUVERTESSURLEMONDEDESAFFAIRES
PATENTER
R
ROBIC
ROBIC+DROIT+AFFAIRES+SCIENCES+ARTS
ROBIC++++
ROBIC+LAW+BUSINESS+SCIENCE+ART
THETRADEMARKERGROUP
TRADEMARKER
VOSIDÉESÀLAPORTÉEDUMONDE,DESAFFAIRESÀLAGRANDEURDELA
PLANÈTE

4
YOURBUSINESSISTHEWORLDOFIDEAS;OURBUSINESSBRINGSYOUR
IDEASTOTHEWORLD

Trade-marksofROBIC,
LLP(“ROBIC”)