Danielle Miller Olofsson

While mandated by the European General Data Protection Regulation (“GDPR”) since 2018, records of processing activities (“ROPAs”) are not a requirement for private sector entities in Canada. But that is beginning to change,...more Because confidentiality incident reporting is mandatory in almost every Canadian province, most private and public sector organizations have some form of incident response strategy – either a formal written process or an ad...more Although Artificial intelligence (“AI”) has been a matter of intense public interest for several years, few substantive laws regulate its use. Reasons for this include a lack of clarity about the scope of what needs to be...more Two recent decisions by Québec’s data protection authority, the Commission d’accès à l’information (the “CAI”), should serve as cautionary tales for any business contemplating the deployment of biometric information...more