Bonjour de Québec!

I am currently on the last leg of a Canadian family road trip that started in Toronto, then through Ottawa for Canada Day, on to Montréal, and ended up in Quebec City. Having been to Canada before, I never quite made it to Quebec City. This is something entirely new.

Montréal is the closest thing I had experienced of the Canadian francophone community to date, and notably, the city is a functioning bilingual one at that. Although, while the city has the global cachet, a cutting-edge contemporary artsy scene, and the international commercial activity lead for the province, Québec City offers up something altogether different: It is the soul of the province with a fierce and fervent grip on French-Canadian identity, the first French foothold being established in 1608. The other metropolitan centers of the Ontario and Quebec provinces have a steeped sense of their history. Quebec, however, happens to be one of North America’s oldest historic settlements and cities — hard to rival. In short, the 17th- and 18th-century architecture that straddles the cobblestone streets of the old town is a “clin d’oeil” to the Europe of old.

And what of the state of Canadian privacy? I did a little research, and IT World Canada claims that there are 60 data protection officers in Canada on LinkedIn and about 15 job postings. I suspect this figure may not be an accurate reflection of the data protection function at large — at the very least, it should grow over time as Canada continues to examine its own data protection legislation both for a national and international environment.

The Standing Committee on Access to Information, Privacy and Ethics recently recommended a strengthened mandate for the federal privacy commissioner, the latter having limited enforcement powers. Moreover, it noted that that the EU General Data Protection Regulation could be a model for Canada’s data protection legislation. Prime Minister Justin Trudeau has expressed cautious interest in boosting Canada’s privacy laws along the lines of the European model, yet no legislation has been proposed. Short of three weeks ago, the Canadian government did announce a summer-long consultation process into “digital and data transformation,” acknowledging that the explosion of data generation is leading to new questions around privacy and security.

Canadian companies with European customers are already struggling to understand how the new regulations in Europe apply to them. The leap forward made by the EU with the GDPR caught many Canadian businesses by surprise, and from what I have read, few were prepared for adoption in function of their European markets and customers ahead of time. As with other countries, a key concern here among business leaders and experts is the potential loss of essential equivalency and adequacy status (in PIPEDA) considering the GDPR. This could have adverse effects on trading positions with the European Union.

As said before by many, it is a natural enough evolution, that businesses should adapt to changing privacy-threshold expectations for managing public relations and legal risk. From a practical standpoint, maintaining two privacy policies for EU and non-EU clients can prove costly, as well as burdensome for businesses to implement and regulators to monitor. With international trends pointing toward stricter privacy policies, it comes as no surprise that the Canadian ethics committee is independently pushing for recommendations for change in line with the controls as afforded under the GDPR — adequacy has a real impact.

Since earlier this year, on the policy side, it seems business leaders, experts and academics have been lobbying the federal government to create a national data strategy to support the expanding power of the data-driven economy, which is widely expected to produce big economic gains for Canada. It appears that call has been heard with the launch of the consultation processes.

In the interim, as the privacy and data protection landscape continues to change globally, Canadian companies — as elsewhere — probably need to facilitate their privacy strategies more than ever.