Personal Information and Data Protection

Privacy

Generative artificial intelligence, data lakes, business intelligence, profiling technology, cookies, biometric data, geolocation, cloud computing services—these are some of the technological advancements that enable an unprecedented collection and use of data that often compromises confidential personal information.

Composed of lawyers with multidisciplinary and complementary expertise, our Personal Information and Data Protection team develops risk mitigation tools and strategies for personal information protection (PIP) that meet the business needs of companies and organizations. It has also devised standardized tools and checklists to ensure the development of proven legal solutions.

• Guidance. Our lawyers draft and negotiate strong contractual provisions for PIP. Leveraging our expertise in the most recent legislative and case law developments, including those regarding the improper management of PIP-related issues and risks, we help implement strategic solutions both proactively and in response to situations. We also support and advise PIP officers in the ongoing management of personal information held by their organization.
• Compliance. We provide advice, legal opinions and training on all legal aspects of PIP, and compliance solutions tailored to any organization (retail businesses, factories, foundations, professional orders, associations, groups, non-profits and so on). We conduct PIP audits and Privacy Impact Assessments (PIA) and provide recommendations for data anonymization and de-identification solutions. We also conduct due diligence in business acquisitions to inform clients about the risks associated with an acquisition target’s handling of personal information.
• Confidentiality incidents and notifications. Drawing on our experience gained from hundreds of suspected or confirmed confidentiality incident cases, our crisis management experts work alongside lawyers from our Litigation team to provide clients with strategic advice based on an integrated approach to the legal, reputational and commercial risks that arise from confidentiality incidents.

If necessary, we enlist the services of recognized IT or media relations experts, or collaborate with those recommended by our clients. We also assist in documenting confidentiality incidents, including maintaining the required confidentiality incident registers, notifying the relevant authorities, coordinating with law enforcement or other investigative bodies, and notifying individuals likely to suffer harm from a confidentiality incident. Our Personal Information and Data Protection team offers a 24/7 monitoring service, providing registered businesses and organizations with prompt guidance if a confidentiality incident occurs.

• Class actions and compensation. The filing of a class action poses a significant risk when allegations of privacy breaches, security breaches or data leaks are made. Our firm has a number of seasoned lawyers specializing in class action defence, all of whom have the necessary expertise to effectively assist our clients in such proceedings.
• Electronic commerce. E-commerce raises specific PIP issues in which our lawyers are well versed, including profiling, managing cookies, and commercial prospecting. We also conduct privacy impact assessments (PIAs), a prerequisite for sharing personal information outside Québec. Using their expertise in applicable European regulations, our lawyers provide guidance to foreign business seeking to engage in e-commerce with local customers without having a physical presence here.
• Health information. Québec’s legal framework governing personal health information is particularly complex due to the applicable laws and the diversity of stakeholders involved. Our lawyers have a deep and practical understanding of this legislation and the legal environment in which they operate. They also provide businesses, professionals and public bodies with practical guidance on the collection, use and management of personal health information. In addition, they have the necessary experience to support clients in related investigations by the RAMQ and various professional orders (physicians, pharmacists, etc.).

Cybersecurity

Our Personal Information and Data Protection team provides tailored legal solutions in the field of cybersecurity. In addition to offering advice and training, we support our clients in selecting technological solutions that comply with relevant legal frameworks, as well as in internal or administrative investigations. Our approach always takes into consideration the legal risks and business realities specific to each case.

• Compliance. We provide advice and training on all legal aspects of cybersecurity. We also support businesses and organizations during cybersecurity audits conducted to prevent threats such as phishing, ransomware and computer system integrity breaches.
• Security incidents. Our lawyers are often called upon in suspected or confirmed security incidents, especially to act as breach coaches. They are versatile, mobile and fluently bilingual, quickly adapting to your strategic and operational constraints. They work hand in hand with the appropriate IT experts for every situation. When a security incident also involves a confidentiality incident, these same lawyers will provide effective guidance and advice.

Access to information

Our lawyers are well versed in the intricacies of all access to information laws, regulations and procedures, both at the provincial and federal levels. We often assist businesses and organizations at every stage of an access to information request to help them safeguard their industrial or financial information, trade secrets and other data that may be subject to restrictions to the right of access. Our lawyers are familiar with the unique aspects of most industries and address the complex challenges associated with personal health information and environmental data, as well as the specificities of the pharmaceutical, security and technology sectors.

• Guidance. Our experts understand that robust contractual provisions are often a key factor in an organization’s ability to successfully challenge a restriction to the right of access to information.
• Responses to requests for access. Our lawyers are highly conversant in the intricacies of access rights restrictions outlined in both the Québec Act respecting Access to documents held by public bodies and the protection of personal information and the federal Access to Information Act.
• Representation. The members of our Personal Information and Data Protection team represent businesses and public bodies in matters before the Commission d’accès à l’information and in applications for review of access decisions by federal government institutions before the Federal Court.