What You Need to Know About the GDPR in Canada

On May 25, 2018, the General Data Protection Regulation (GDPR) will come into force. This law creates new obligations for Canadian businesses who collect or handle personal information about people living in the European Union (EU).

We’ve briefly summarized what you need to know about the GDPR in Canada from our perspective as digital marketers. Keep in mind that we’re marketing geeks, not lawyers — but we do hope this information provides a good starting point.

GDPR rules

What is the GDPR?

The GDPR lays down rules on the protection and movement of Europeans’ personal data both within and outside the EU. It aims to harmonize the laws on data privacy in line with the European Charter of Fundamental Freedoms, which gives EU citizens certain rights regarding their personal data.

The regulation came about back in 2016, but it does not come into force until May 25th, 2018. As that ‘deadline’ approaches, it’s no surprise many Canadian businesses are wondering whether the GDPR applies in Canada and, if so, what they need to do about it.

The short answer is yes: if you do business in the European Union, it’s likely the GDPR will apply to you, even if you’re based in Canada.

We’ll go into more detail about what that means next.

What Does the GDPR Do in Canada?

The GDPR regulates how businesses handle personal information about individuals who reside in the European Union. That includes the business’s European customers, employees, associates, and others on whom the organization collects data.

As a Canadian business, you must follow the GDPR when collecting personal information from European citizens if you:

  1. Have an establishment in the European Union.
  2. Offer goods or services to people in the European Union
  3. Monitor the behaviour (including online behaviour) of people in the European Union.

How to Handle Personal Data Under the GDPR

Personal data includes any information that relates to an identifiable person, like a name, surname, I.D. number, or home address. It also includes aspects of an individual’s digital footprint, like their email address, IP address, or cell phone location data.

If your business has an online presence, chances are that you collect at least some data that falls under the category of personal data.

The GDPR establishes six main principles on how businesses (including Canadian businesses) should handle personal data:

  1. All data must be collected and processed lawfully, fairly, and in a transparent manner. In most cases, you may only collect or process someone’s data after obtaining consent to do so (more on that in the next section).
  2. You need a specific, legitimate, lawful reason to collect data. No hoarding personal information ‘just because’. If you’re going to collect data, you have to do it with a specific purpose in mind!
  3. You must limit your data collection to what is necessary to fulfill your purpose. In other words, don’t take more data than you need. If all you need is a name and an email address, don’t ask for a phone number as well.
  4. You have an obligation to keep the data accurate and up-to-date. Have measures in place to avoid keeping false or outdated information.
  5. You cannot keep data for longer than is necessary to fulfill your purpose. Once you’re done with it, destroy it.
  6. You are responsible for data security. If you store the data on an IT system, you must ensure only authorized parties can access it; if you keep physical copies, keep them in a secure location. You also have an obligation to inform people in the event of a data breach.

Collecting Private Data

What is Consent to Collect Personal Data?

Consent is one of the major areas where the GRDP differs from Canada’s federal data privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). Whereas PIPEDA in many cases allows for implied consent, the GRDP is strict about when and how businesses should get permission to use someone’s personal information.

As a business, you must obtain clear, affirmative consent in order to collect and process personal data, meaning the person actually has to indicate their permission somehow. For example, an opt-out system like a pre-checked box on a web form not constitute consent.

Consent must also be freely given, specific, informed, and unambiguous. The person you’re asking must know who you are and what you plan to do with the data, and that they can refuse or withdraw consent at any time.

For children under 16, you must obtain consent from the child’s parent or guardian.

How Canadian Businesses Can Prepare for the GDRP

To reiterate, the GRDP mandates that all businesses who operate in the EU, offer goods and services to EU citizens, or monitor the behaviour of EU citizens must follow the rules for data protection in the GRDP. That includes Canadian businesses. If you do business with Europe, it’s incumbent on you to prepare for the GDRP now.

The exact steps you take will depend on how you operate, but the following are good starting points:

  1. Review your current policies and processes on data collection. What do you collect, and why? Do you obtain and record consent?
  2. Create new boilerplate contract clauses that meet the law’s requirements. Consult with your lawyer on this one. If you run an e-commerce website or have automated communication with European customers, it’s essential that your agreements fall in line with the new regulation.
  3. Start keeping records. You will have to be able to prove you have taken steps to follow the law if ever called into question.
  4. Decide how to approach the ‘ask’. People might not be willing to hand over their personal data unless you offer them a good reason to. Think about what you can give your customers in return for their consent.

#CanadaProud: Spotlight on the Toronto-KW Tech Corridor

It boasts the country’s highest concentration of skilled tech companies and employees. It attracts top talent and investment capital from around the globe. It’s where you’ll find tech giants, like Google, and a swarm of competitive startups leading breakthroughs in biotech, artificial intelligence, and IT.

On paper, we call it the Toronto-KW tech corridor. Some dub it Silicon Valley North.

Whatever the name, we’re proud to be a part of Canada’s thriving technology hub.

The 112KM corridor between Toronto and Kitchener-Waterloo is the largest technology cluster in the country, representing 17% of our annual GDP and employing over 200,000 tech workers across 15,000 companies

It’s home to Canadian innovators like Blackberry, Shopify, and OpenText. But it’s not just homegrown Canadian companies driving growth in the corridor.

Last year, Google unveiled a new office in Kitchener with room for up to 1,000 employees. Ford is making sizable investmens in the province, including a research facility in Waterloo. The MaRS innovation hub near the University of Toronto houses workers from Facebook, Paypal, AirBnB, Autodesk, Etsy, and 200 startups.

So, what draws the tech world to our doorstep?

To start, the region is a wellspring of talent.

Our educational institutions are known worldwide for academic excellence. Many of Ontario’s 20 universities and 24 colleges are located right here in the corridor, offering extensive internship and co-op education programs to serve the technology industry. Over 38,000 students in Ontario graduate with degrees in math, engineering, or science each year.

One of the challenges we’ve faced is keeping these students here in Ontario once they graduate. In the past, many of Canada’s talented grads left to pursue opportunities in Silicon Valley. But that’s beginning to change. The public and private sectors are working together to fund technology entrepreneurship and innovations in Toronto-KW, fueling the creation of more jobs for skilled tech workers. Ontario invested $3 billion in such spending over the past six years, and the federal government has committed an additional $950 million to support clean tech, bioscience, and digital innovation in the future.

Not only have we made headway in stopping the brain-drain, but the Toronto-KW tech corridor is drawing global talent as well. More American citizens and foreign nationals are leaving the United States to work in Canada. Our vocal pro-immigration stance and strong investment in tech has made the corridor an attractive option for workers, and both universities in Waterloo region are reporting double-digit growth in international student applications this year.

A workforce as diverse as ours is a force to reckon with. As Prime Minister Justin Trudeau wrote on Quora, “Having a group of smart, capable people focus on the same problem from a range of different perspectives, backgrounds and lived experiences is much more likely to come up with great answers than a homogeneous group would.”

In addition to world-class academic institutions and research centers, the corridor has a number of organizaions dedicated to supporting entrepreneurs. Waterloo region is fertile ground for startups, with over 5,000 budding companies growing there today.

For a glimpse at the future of Canadian technology, you need only step through the doors of the many start-up incubators in Kitchener-Waterloo. One such organization is the Accelerator Centre, an incubator dedicated to helping startups grow and compete on the world stage. Among its alumni are Trustpoint Innovation Technologies, a machine-to-machine communications developer that made Deloitte’s Fast 50 list; Magnet Forensics, which recently opened new headquarters in Waterloo; and yours truly, Trafficsoda.

The Toronto-KW tech corridor has a long way to go to catch up to Silicon Valley, but it’s on track to become one of the foremost innovation hubs in the world.

Canadian Tech: A Story of “The Hustle”

Jessica Chalk, TrafficSoda and Growing a Company in the Canadian Tech Industry

Ambitious. This is the one word that our President and CEO, Jessica Chalk, uses to describe the rapidly emerging Canadian technology industry. TrafficSoda was born and bred (and is growing into its teenage years) out of Kitchener-Waterloo and Guelph, the hub of new tech growth in Canada. With the upcoming celebrations for Canada 150, I sat down with Jessica to talk about growing a business in this new and booming Canadian tech landscape.

Jessica started in tech before TrafficSoda did. She began her career in the Accelerator Center, a Waterloo based Start-Up Incubator, which has supported the success of local legends like Axonify, Clearpath Robotics, Kik, Miovision, Sortable, and Plasticity Labs. Simply being around the dynamic and innovative energy of the ‘AC’ is what drove Jessica to start TrafficSoda (though in a much earlier iteration than what it is today).

“The hustle, the determination, and the excitement of all these entrepreneurs around just helped me all of a sudden decide that I wanted to take the leap,” Jessica remarked enthusiastically. It’s obvious that this environment still pushes Jessica today just as much as it did back then.

TrafficSoda began in 2013 with support from what seems like everyone in town. The Accelerator Center provided a location for the early phases of the start-up, Laurier supplied office space, resources and mentors, Communitech offered support, local mentors furnished advice during high and low times, the Government of Canada delivered a Jumpstart grant that helped pay for part of the bill, and early investors gave it all a chance.

This close-knit, committed community support is what defines the Canadian tech industry to Jessica: the championing of every single entrepreneur who wants to step forward. That unique generosity and genuine helpfulness seems built into the infrastructure of the industry itself. Individuals, public and private companies, universities, educational institutions, and people who have “been there, done that” all provide support.

“All you have to do is ask,” Jessica simply reminds me. “[In Canada], we are not just one in a million. We are one in a thousand, one in a hundred, and we have access to the right people.”

Being Canadian is a core facet of the TrafficSoda identity. Our team is made up of people coming from Guelph to K-W to North Bay to Alliston to Toronto. Our chairman is Jim Estill, long time local tech entrepreneur and private sponsor for 58 Syrian refugee families. Our VP of Operations, Mohammed Helu, is one of those Syrian refugees. That diversity is what makes us strong.

Being Canadian provides opportunity. Being Canadian helps our clients feel comfortable and let their guard down more than they normally would. Being Canadian in the North American tech industry allows us to be the ‘David’ next to the American ‘Goliath.’ Being Canadian gives us an entrepreneurial spirit. Being Canadian gives us a chance to be a part of something new and exciting, where our collective potential is limitless.

As for the next 150 years? Jessica hopes to see a focus from the community on companies that are ready to scale and grow, supporting them as much as we are currently supporting the startups and founders. The momentum needs to keep moving forward, so we can transition from an emerging tech industry to a solidified one. With the current political climate, Jessica believes this is the perfect opportunity to define exactly what is the “Silicon Valley of the North.”

The unique Canadian tech scene gets its identity from its inclusiveness, collaboration and passion. This is seen time and time again, as new entrepreneurs are supported and successful start-ups are championed. Even TrafficSoda, as we transitioned from a purely tech firm to a digital marketing one, still feels accepted and backed by the community. We feel honored and
excited to be a part of such a dynamic, exhilarating, and full-steam ahead community. Cheers to Canada’s 150th!


Image: niroworld