Caroline Deschênes

,  CIPP/C, CIPM Partner
Key practice areas
Personal Information and Data Protection, Litigation and Dispute Resolution, Internal and Regulatory Investigations, Compliance and White Collar Defence, Civil and Commercial Litigation, Class Actions
Québec Bar 2007
Montréal
+1 438 844 7827
caroline.deschenes@langlois.ca
Download Deschênes, Caroline's card

Caroline Deschênes practises civil and commercial litigation and has specific expertise in the areas of privacy, cybersecurity and access to information. She advises clients of all sizes in a variety of fields on putting in place and implementing privacy compliance programs, on managing confidentiality incidents, interacting with various regulators and complying with Canada’s anti-spam legislation. She also represents a variety of businesses and public bodies in connection with access to information issues, particularly before Québec’s Commission d’accès à l’information.

Caroline holds the CIPP/C (Certified Information Privacy Professional/Canada) and CIPM (Certified Information Privacy Manager) certifications issued by the International Association of Privacy Professionals (IAPP), which attests to her in-depth understanding of the legislative and regulatory environment surrounding the protection of personal information and to her competence in helping clients establish, maintain and manage a compliance program at all stages of the data life cycle. She is also an active member of the executive committee of the Privacy and Access Law Section of the Canadian Bar Association, which she chaired in 2022-2023. She also sat on the advisory committee for the review of the Act respecting the protection of personal information in the private sector, which gave rise to Bill 64 and the reform of Québec’s rules governing the protection of personal information.

She frequently speaks at conferences and continuing legal education seminars on a variety of topics related to these areas. She has also been recognized by respected legal directories for her expertise in data protection and privacy.

Before joining the firm, Caroline practised commercial litigation for more than 10 years at an international law firm, where she focused on class actions. She has represented large corporations before all levels of Québec courts and various administrative tribunals.

Class actions

Defended an international company in a class action arising from a data breach following a security incident.

Cybersecurity

Advises businesses and public bodies on all aspects of confidentiality incidents, including putting in place an action plan, assessing the risk of harm and disclosure to regulators and the individuals concerned.

Protection of personal information

Advises public bodies and businesses of all sizes on putting in place and implementing a compliance program regarding the protection of personal information.

Access to information

Represents businesses and public bodies regarding all aspects of access to information (including responses to access requests, applications for review, and defending third parties whose confidential information is targeted by an access request).

  • Canadian Legal Lexpert Directory – Data Protection and Privacy, 2022-2025
  • Best Lawyers in Canada – Privacy and Data Security Law, 2022-2025
  • John Williamson Frederick Peacock Memorial Scholarship, awarded to a McGill student with a good academic record in order to pursue graduate studies abroad, 2005
  • Dean’s Honour List, McGill University's Faculty of Law, 2001-2004
  • Allan Neil Assh Memorial Award, awarded to the student with the highest standing in the Business Associations course, 2004
  • Hans Hermann Oppenheimer Scholarship, awarded to a student who has shown particular promise in the field of public international law, 2003
  • Harry Batshaw Prize, awarded to the student with the highest standing in the Foundations of Canadian Law course, 2001
  • Canadian Bar Association:
    • Member, since 2007
    • Member of the Executive Committee of the Privacy and Access Law Section, since 2018
    • Chair of the Executive Committee of the Privacy and Access Law Section, 2022-2023
  • International Association of Privacy Professionals (IAPP), Member, since 2016
  • Advisory Committee on the revision of the Act Respecting the Protection of Personal Information in the Private Sector, Participant, 2017-2019
  • École primaire Saint-Laurent, Member of the Governing Board, since 2023
  • Panelist: L’anonymisation des renseignements personnels au Québec : piste de conformité technologiques et pratiques 101 pour juristes [Anonymisation of personal data in Québec: Technological and practical compliance 101 for lawyers], as part of the Développements récents en matière de protection des renseignements personnels et droit de l’intelligence artificielle, Barreau du Québec, Montréal, March 4, 2025.
  • Moderator: Biometrics in use – how to stay on the right side, panel as part of the CBA Privacy and Access Law Conference, presented by the Canadian Bar Association Privacy and Access Law Section, Ottawa, November 7, 2024.
  • Moderator: The Regulators’ Perspective, CBA Privacy and Access Law Symposium, Ottawa, November 10, 2023.
  • Speaker: Navigating the Data Privacy World: Quebec Charts a New Journey for Businesses, IAPP Canada Privacy Symposium, Toronto, May 26, 2022.
  • Speaker: Protection des renseignements personnels : se préparer à la Loi 25 [Privacy: Getting ready for Québec Law 25], presented in collaboration with the Québec Bar, webinar, March 24, 2022.
  • Speaker: Loi 25 sur la protection des renseignements personnels : considérations techniques au-delà des enjeux juridiques [Technical considerations on Québec Law 25], Langlois Knowledge, webinar, March 23, 2022.
  • Speaker: Canada Privacy – Updates on Laws and Regulatory Developments, presented in collaboration with OneTrust, webinar, September 16, 2021.
  • Speaker: Quebec Privacy Law Reform – What Businesses Need to Know, Privacy Symposium Online organized by IAPP Canada, webinar, June 21, 2021.
  • Speaker: Update on Canadian Privacy Landscape, presented in collaboration with the Canadian Bar Association, webinar, June 3, 2021.
  • Co-speaker: Se préparer à la réforme des lois protégeant les renseignements personnels et la vie privée [Preparing for new privacy legislation in Québec], Langlois Knowledge, webinar, January 13, 2021.
  • Co-speaker: Se préparer à la réforme de la loi encadrant la protection des renseignements personnels au Québec [Preparing for the reform of the law governing personal data protection in Québec], Langlois Knowledge, webinar, November 19, 2020.
  • Speaker: Privacy in Québec, Access to Information and Privacy Law Annual Symposium organized by the Canadian Bar Association, Ottawa, October 19, 2019.
  • Co-speaker: Cyber-risks: managing a security incident, Développements récents en droit des enquêtes internes et réglementaires, Québec Bar, April 12, 2019.
  • Speaker: Deuxième symphonie d’affaires | RGPD : les 100 premiers jours [Second Symphony | GDPR: The First 100 Days], Symphonie d’affaires workshop series, Langlois Knowledge, Montréal, September 26, 2018.
  • Co-speaker: Les cyber-risques [Cyber-Risks], Langlois Knowledge, Montréal, October 12, 2018.
  • Co-speaker: Demystifying the GDPR for Quebec enterprises, eCommerce Québec, Montréal, October 5, 2018.
  • Speaker: GDPR 101: What Canadian businesses need to know about the new European Regulation, Langlois Knowledge, 2018.
  • Speaker: Cybersecurity: a legal kit to prepare for the inevitable, GoSec Conference, Montréal, 2017.
  • Speaker: Big Data and The Internet of Things, Montréal, 2016.

LL.M., University of Cambridge, 2006

B.C.L./LL.B., with Great Distinction, McGill University, 2004

Featured Articles

Publications
January 28th, 2025

Use of biometric data: Québec’s Privacy Commissioner keeps the bar high
The use of biometrics is growing in both the private and public sectors. For the first time since Law 25 came into force, the Commission d'accès à l'information (CAI) has had the opportunity to render a decision on the use of a facial recognition system. The decision is another illustration of the CAI's rigorous standards regarding biometric systems.
Read more
Publications
October 28th, 2024

Information security incident management: A new regulatory framework for financial institutions and credit assessment agents
On October 23, 2024, the Regulation respecting the management and reporting of information security incidents by certain financial institutions and by credit assessment agents was published in the Gazette officielle du Québec. The Regulation will come into force in six months and is intended to provide a framework for the management and reporting of information security incidents by certain provincial financial institutions. In the event of non-compliance, the Regulation also provides for administrative penalties.
Read more
Publications
October 25th, 2024

AI back in the regulatory spotlight: California passes new legislation
Over the course of September, more than 30 bills were introduced in California aimed at regulating the development and use of artificial intelligence, in particular by imposing specific requirements on generative AI systems. The state has enacted several AI-related bills, including SB 942 California AI Transparency Act and AB 2013 Generative Artificial Intelligence: Training Data Transparency.
Read more