![workplace-with-people-in-walking-in-blurred-motion-in-modern-office-space_AdobeStock_714071973](https://www.nortonrosefulbright.com/-/media/images/nrf/hero/workplace-with-people-in-walking-in-blurred-motion-in-modern-office-space_adobestock_714071973.jpeg?w=265&revision=757b8aa8-f74f-4e2d-9ccd-084ec5192278&revision=5250277392097387904&hash=380B464034E4102358A0D456AAB43445)
Publication
Merger law reform in Australia: What next after the Exposure Draft?
As expected, the Australian Commonwealth Treasury released an exposure draft for the proposed new Australian merger regime on 24 July 2024.
Canada | Publication | September 29, 2023
With most provisions of the Act to modernize legislative provisions as regards the protection of personal information (Act 25) having just come into effect on September 22, public bodies and enterprises (organizations) will now need to conduct privacy impact assessments (PIA) during various projects that involve personal information. A PIA is an impact analysis that takes all personal information of the persons concerned into consideration to prevent the mismanagement of that information and ensure its protection throughout the project.
To help organizations, the Commission d’accès à l’information (CAI) published a guide (available in French only) that walks them through conducting a PIA. The guide describes the steps of a PIA and details various factors that must be considered in this analysis, including the specific considerations that apply in different situations. Interestingly, even though a PIA is mandatory in some contexts, Act 25 does not specifically indicate how it should be conducted. The CAI guide is therefore only intended for information purposes.
In its guide, the CAI summarizes the steps to be taken when conducting a PIA, which it emphasizes must begin early on in the project so that the assessment can be completed before the project is implemented. There are four steps to a PIA:
1. Determining whether an assessment is necessary
A PIA is mandatory in certain cases, notably the acquisition, development or overhaul of an information system or electronic service delivery system involving personal information or in cases where personal information will be released outside Quebec.
Regardless of the situation, the CAI believes it is good practice to conduct a PIA whenever a project involves personal information.
2. Preparing a PIA
A PIA is preceded by a preparatory phase, in which questions are raised regarding the project and its scope, the personal information concerned and the organization’s privacy obligations.
The CAI repeatedly stresses the importance of a PIA being proportionate to the project and to the personal information concerned. When preparing a PIA:
3. Analyzing and evaluating privacy
In this step, the factors that could impact the privacy of the persons concerned are analyzed using the information obtained in the previous step. The privacy factors that will be assessed are:
4. Reporting on the assessment
For this last step, the CAI warns organizations that they should be able to explain and justify the PIA’s findings, notably in the context of an inspection or investigation. To achieve this, it is recommended that a report be drafted and frequently updated. The CAI guide indicates what this report should contain and how it should be disseminated. The CAI also published a model PIA report (in French only) to help organizations prepare one.
In essence, the CAI guide provides organizations with valuable guidance and insight on how to complete their PIAs, and the information is accompanied by examples, diagrams and questions to help them in that task. The guide is grounded in the principles of prevention, privacy protection, and the project’s proportionality to the privacy risks in a constantly shifting environment.
The authors would like to thank Marie-Dominique Simard, articling student, for contributing to this legal update.
Publication
As expected, the Australian Commonwealth Treasury released an exposure draft for the proposed new Australian merger regime on 24 July 2024.
Subscribe and stay up to date with the latest legal news, information and events . . .
© Norton Rose Fulbright LLP 2023