Privacy and Data Management

Osler is a program partner of the Information Accountability Foundation (IAF), the preeminent global information policy think tank that works with regulatory authorities, policymakers, business leaders, civil society and other key stakeholders around the world to help frame and advance data protection law and practice through accountability-based information governance.

Our clients span a broad range of industries and sectors, including the following:

• Banking and financial services, including insurance
• Business process outsourcing
• Education, including universities, colleges and school boards
• Entertainment and media
• Healthcare, including healthcare service providers and health research
• Retail and consumer products
• Technology and social media
• Telecommunications
• Transportation
• Utilities

Drawing on our extensive experience, innovative skills and practical solutions, we

• advise clients on compliance with all Canadian federal and provincial privacy and data-management laws
• advise clients on compliance with Canada’s anti-spam legislation (CASL)
• advise and develop policies and guidelines applicable to privacy issues regarding marketing and advertising programs and campaigns, including social media–related marketing, online behavioural advertising, and marketing to children
• address and advise on cross-border privacy issues, including the transfer of data outside Canada
• help clients manage significant privacy information security breaches and regulatory notification issues for individuals
• assist clients with the compliance and data-governance issues associated with data analytics, fraud-detection programs and other emerging data uses
• advise on enterprise-wide privacy information–governance compliance monitoring programs
• advise and respond to investigations and complaints filed with privacy regulatory authorities
• advise clients on privacy issues and requirements on mergers and acquisitions and corporate finance transactions, and negotiate privacy law provisions for business transactions
• address workplace privacy issues, including email and Internet use policies affecting an employee’s expectation of privacy, and identify privacy-compliant practices for handling and using employee data
• advise clients on management of individual requests for access to, and/or correction of, personal information
• develop and perform comprehensive Privacy Impact Assessments (PIAs), privacy and information risk assessments, preparation of data flow maps
• develop and implement data-classification and records-management programs
• develop and implement privacy and data-use and -protection policies and procedures that comply with applicable laws and that maintain business flexibility and public and business partner trust
• develop and implement policies and procedures necessary to meet payment card industry (PCI) standards
• advise clients on training and awareness programs