Summer is winding down – and with it most state legislative sessions here in the United States. So, let’s take this opportunity to look to our northward neighbors in Canada.
Aside from their impressive haul of 24 Olympic medals (how exciting was that Women's Soccer final?), there have been some major legislative and regulatory updates in 2021 so far in the areas of:
Two major data privacy bills are currently under consideration, including one at the federal level that could impact employers both in and outside of Canada. Data transfer (particularly to the EU) has been a concern so there is likely to be movement on these laws this year. We'll highlight these in future updates if they pass; they will likely go into effect in late 2022 or later, so there will be time to get ahead of compliance.
- Federal Level - Bill C-11 – The Digital Charter Implementation Act, 2020
- Introduced in the fall of 2020 and has a strong chance of passing before the end of 2021. It would create the Canada Consumer Privacy Protection Act (CPPA) (replacing the Personal Information Protection and Electronic Documents Act (PIPEDA)). It would also create the Personal Information and Data Protection Tribunal.
- Establishes individual data privacy rights that mirror the GDPR and CCPA, and focuses on consent for collection, use, and disclosure of personal information.
- Gives the enforcement body much greater powers than under PIPEDA, including the ability to levy significant penalties for noncompliance.
- Would impact businesses outside of Canada. Currently no effective date set.
- Provincial Level – Quebec – Bill 64 – An Act to Modernize Legislative Provisions Respecting the Protection of Personal Information
- Introduced in the fall of 2020 and is reasonably expected to pass this fall, in which case it would go into effect in the fall of 2022.
- It would reform the two major data privacy bills that currently control in Quebec—the Access to Information Act and the Private Sector Act.
- Mirrors aspects of the PIPEDA and the GDPR with regards to privacy impact assessments, individual data privacy rights, and consent requirements.
Anti-Money Laundering / Combatting Terrorist
- Amendments came into force on June 1, 2021, impacting the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (the PCMLTFA) and its implementing regulations. Additionally, updates have been made to related guidance by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC).
- Businesses that qualify as reporting entities (REs) under this Act should consult with their legal partners if they haven't already, but some of the high-level changes are below:
- New and revised definitions
- Additional foreign money services businesses (FMSBs) obligations
- Virtual currency (VC) obligations for all REs, including submitting Large Virtual Currency Transaction Reports (LVCTRs) to FINTRAC starting on June 1, 2021
- Prepaid payment products and accounts obligations for financial entities (FEs)
- Obligations for life insurance companies, brokers and agents when they are acting as FEs
- Beneficial ownership obligations extended to all REs
- Business relationships and ongoing monitoring obligations extended to all REs
- Politically exposed persons obligations extended to all REs
- Deemed receipt of funds and VC obligations
- Repeal of third-party deeming for persons acting on behalf of an employer
- Certain record keeping obligations
REMINDER: Workplace Harassment & Violence Prevention Training
- We covered this in our January roundup, but if you missed it or weren't aware, training requirements at the federal level were updated effective January 1, 2021. Employers subject to the Canada Labour Code will now be required to provide training on workplace harassment and violence every 3 years. The new law and regulations provide some high-level content requirements. This change was part of a larger overhaul to the Labour Code.
- There's still time to comply; employees who started before January 1 must be trained before January 1, 2022. Employees who started on or after January 1 must be trained within three months of their first day of employment.