Here we are, 1 Sept. Hard to believe summer's already in its twilight, isn't it? If you're anything like other Canadian privacy pros, this summer likely felt especially short as you scrambled to get ready for the coming into force of the bulk of Quebec's Law 25. 22 Sept. looms just a few weeks away now.
As you reflect on the steps you've taken to prepare, you might be wondering how you and your clients stack up against other organizations both in terms of readiness and top-line concerns with the law's new requirements. Thankfully, the good folks at Gowling WLG and IAB Canada have released the results of an interesting survey they conducted on just that.
Some of the big takeaways?
As expected, a majority of organizations expressed a need for more clarity amid Law 25's ambiguities and the lack of official guidance. Pair that with the prospect of stiff penalties and limited resources to meet requirements, and it's no wonder why Pepto-Bismol was this year's summer cocktail of choice among Canadian privacy pros.
Organizations indicated they didn't have adequate time, resources and personnel to achieve compliance. A whopping 70% indicated they weren't yet compliant with all Law 25 requirements due to a lack of clarity in the statute, while 50% also attributed this compliance gap to a lack of official guidance. There's lots in there to digest, and I encourage you to read the report.
One thing the report makes clear is that interesting times are certainly ahead. Quebec's data protection authority, the Commission d'accès à l'information du Quebec, is expected to release guidelines on consent this fall. While absolutely welcome, it's unfortunate this guidance will only come after most of Law 25 is in effect. Hopefully, guidance on other subjects like confidentiality by default, automated decision-making and profiling, and data transfers come soon after to help organizations understand how the CAI will interpret the law. But as a colleague of mine rightly pointed out, it will take enforcement actions to truly show where the lines will be drawn. Let's just hope the CAI takes a measured approach given the widespread uncertainty surrounding this law as it comes into force 22 Sept.