Categories
Information Technology & Licensing Policies & Pro-Active Compliance

Updates to Cybersecurity and Artificial Intelligence Legislation in Canada

The federal government of Canada is taking significant strides to bolster its privacy legislation, recognizing the critical importance of these fields in today’s digital age. With cyber threats on the rise and artificial intelligence (“AI”) technologies evolving rapidly, the need to strengthen Canada’s legal framework as it relates to these technologies and managing personal data is paramount. These updates aim to enhance cybersecurity measures, protect personal data, and ensure ethical and responsible AI development and deployment.

This blog will provide an overview of ongoing updates to cybersecurity and AI legislation in Canada and their implications for businesses, consumers, and the broader digital landscape.

Current Cybersecurity Legislation

The primary legislation governing Canada’s privacy laws is the Personal Information Protection and Electronic Documents Act (also referred to as “PIPEDA”). In essence, PIPEDA governs how private sector organizations collect, use, and disclose personal information during commercial activities by setting out rules or obtaining consent, limiting the collection of personal information, and mandating safeguards for businesses collecting such information.

As mentioned above, a fundamental principle of PIPEDA requires organizations to obtain meaningful consent from individuals before collecting, using, or disclosing their personal information. This means that organizations must clearly explain the purposes for which they are collecting personal information and obtain consent that is informed, voluntary, and appropriate for the sensitivity of the information. PIPEDA also requires organizations to protect personal information by implementing appropriate security safeguards and to be transparent about their privacy practices. Businesses and organizations that fail to comply with the Personal Information Protection and Electronic Documents Act can face significant fines.

However, despite its principles and frameworks, PIPEDA has its weaknesses. From 2018 to 2022, the Commissioner and the House Commons Standing Committee on Access to Information, Privacy and Ethics have called for its reform in the rapidly changing digital environment, especially concerning the collection of mobility data and the regulation of AI. In response, the Minister of Innovation, Science and Industry tabled Bill C-27 to address these concerns.

Bill C-27: New Privacy Protection and AI Regulation

Bill C-27 creates three new Acts: the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act. Together, these Acts reform PIPEDA and would create a new privacy regime in Canada.

It has completed the second reading in the House of Commons and is currently undergoing committee discussions by the Standing Committee on Industry and Technology. The Bill still needs to be approved by the Senate, so subject to the changes that may occur during that stage, the proposed Acts currently include the following provisions:

Consumer Privacy Protection Act

The Consumer Privacy Protection Act replaces Schedule 1 of PIPEDA but would maintain its consent provisions. It also includes exceptions to the requirement for consent, such as disclosing personal information for socially beneficial purposes. Crucially, it also includes consumers’ key rights regarding their data. For example, it consists of the right to erasure of data, and the right to an explanation concerning decisions made by an automated decision system.

If an organization were to fail to comply, the Consumer Privacy Protection Act grants the Privacy Commissioner powers to make decisions and recommendations for penalties, which cannot exceed $10,000,000 and 3% of an organization’s gross global revenue, and fines the higher of $25,000,000 and 5% of an organization’s gross global revenue.

Personal Information and Data Protection Tribunal Act

This Act establishes the Personal Information and Data Protection Tribunal and its principles of operation. This Tribunal would be the body that would deal with appeals of decisions and penalties made under the Consumer Privacy Protection Act.

Artificial Intelligence and Data Act

In general, the Artificial Intelligence and Data Act provides the first extensive regulatory framework for AI systems. It requires individuals and businesses to identify, assess and mitigate the risks of harm or biased output of AI systems. It also allows a minister broad power to require an organization subject to the Act to cease making available an AI system if there are reasonable grounds to believe that this system gives rise to a serious risk of imminent harm.

Contact Bader Law to Learn More About Impending Privacy Regulations and Proactive Policy Compliance

At Bader Law, our business law team successfully advises tech start-ups and business owners on privacy issues, including cloud computing, blockchain, other crypto-currency, and FinTech. We are familiar with the various challenges that organizations face, particularly in the technology sector, and work closely with entrepreneurs and employers to ensure that their legal needs are met.

With offices in Mississauga and Oakville, the corporate lawyers at Bader Law have decades of experience helping businesses grow and expand, and helping corporations negotiate licensing agreements and prepare companies for exit events. We are thorough, efficient, and focused on delivering the best possible outcome for every client. Contact us online or at (289) 652-9092 to discuss your matter with a member of our team.

Categories
Employment Law HR Consulting & Employment Law

Digital Platform Workers’ Rights Act: An Overview

In April 2022, Ontario passed the Digital Platform Workers’ Rights Act, also called Bill 88. Although the Digital Platform Workers’ Rights Act is not yet in force, it is expected to be proclaimed into force this year.

This blog post will explain what the Digital Platform Workers’ Rights Act is, who it applies to, and how it will impact certain employment relationships.

What is the Digital Platform Workers’ Rights Act?

When in force, the Digital Platform Workers’ Rights Act will provide certain rights and protections for workers who make income from digital platforms, such as ride-share drivers, couriers, or other workers who obtain their work assignments through the use of a “digital platform.”

This piece of legislation can be thought of as a parallel legal regime to the Employment Standards Act, which provides minimum protections to employees. The requirements of the Digital Platform Workers’ Rights Act, however, will apply to all workers who obtain work through a digital platform, regardless of whether that worker is considered an “employee.”

What is a “digital platform”?

The Digital Platform Workers’ Rights Act defines “digital platform” as “an online platform that allows workers to choose or accept or decline digital platform work. In turn, “digital platform work” is defined as the “provision of for payment ride share, delivery, courier or other prescribed services by workers who are offered work assignments by an operator through the use of a digital platform.” The worker is then able to accept or decline the work assignment. Examples of digital platforms include Uber, DoorDash, SkipTheDishes, and Lyft.

What rights and protections does the Digital Platform Workers’ Rights Act provide to workers?

The Digital Platform Workers’ Rights Act includes the following rights and protections for digital platform workers:

  • Right to a minimum wage. Operators of digital platforms will be required to pay workers at least the statutory minimum wage under the Employment Standards Act for each work assignment, which is currently $15.50 per hour. An operator cannot include tips or gratuities in the calculation of minimum wage.
  • Rights to tips and gratuities. Digital platform operators will not be permitted to withhold any tips or gratuities from a worker.
  • Right to maintain access to the digital platform. Operators of digital platforms will not be permitted to remove a worker’s access to the digital platform unless the operator has provided the worker with a written explanation of why access was removed; and, if the removal is for 24 hours or longer, the worker must be given at least two weeks written notice in advance of the removal.
  • Right to recurring pay period and payday. Operators of digital platforms must establish a recurring pay period and recurring payday. Operators will be required to pay workers all amounts earned during the pay period (including tips and gratuities) by the payday for that period.
  • Protection from reprisal. Digital platforms operators will not be permitted to intimidate, threaten, or penalize a worker because the worker asks for compliance with the Digital Platform Workers’ Rights Act, makes inquiries about their rights under the Act, files a complaint under the Act, exercises a right under the Act, gives information to a compliance officer, or testifies or participates in a proceeding under the Act.

What information does a digital platform operator need to provide to a worker?

Digital platform operators must provide workers, in writing, with certain information within 24 hours of them gaining access to the digital platform, including:

  • a description of how pay for digital platform work is calculated;
  • whether the operator collects tips or other gratuities and, if so, when and how they are collected;
  • the recurring pay period and recurring payday established by the operator as described above;
  • any factors used to determine whether work assignments are offered to workers and a description of how those factors are applied; and
  • whether the digital platform uses a performance rating system and whether there are consequences based on a worker’s performance rating or failure to perform a work assignment, and, if applicable, a description of those consequences.

Digital platform operators must provide a worked with written details pertaining to the work assignment when it is offered to a worker, including:

  • the estimated amount the worker will be paid for the work assignment along with a description of how that amount is calculated;
  • any factors used in determining whether to offer the work assignment to the worker; and
  • whether there are consequences based on the worker’s performance rating on the work assignment, or the worker’s failure to perform the work assignment and, if applicable, a description of those consequences.

Further, digital platform operators must provide a worker with specific information within 24 hours of completion of a work assignment by a worker, such as:

  • the actual amount the worker will be paid for the work, a description of how the amount was calculated, and when the amount will be paid; and
  • the amount of any tips or gratuities that were collected by the operator in respect of the work assignment, the amount of tips or gratuities that will be paid to the worker, and when the amount will be paid.

Digital platform workers are also entitled to obtain information about their performance ratings. This information can include details regarding when a worker must be given an average rating and within what time frame.

Operators of digital platforms will be required to keep certain records

Digital platform operators will be required to keep records of certain information about each worker using the digital platform. Operators must retain these records for at least three years after the worker’s access to the digital platform is terminated. This information includes:

  • the worker’s name and address;
  • dates on which the worker was given access to the operator’s digital platform to perform work assignments;
  • dates on which the worker’s access to the operator’s digital platform was removed or reinstated;
  • the dates that the worker performed the work assignments along with the times that each work assignment started and finished; and
  • any amounts paid to the worker in respect of a work assignment, the dates the amounts were paid, and a description of the payments, including tips or gratuities or other amounts that were included in the payment.

Contact Mississauga Business Lawyers at Bader Law for Trusted Advice on Employment Law Disputes and Employment Standards

The experienced employment lawyers at Bader Law regularly assist business owners and entrepreneurs to ensure that they maintain compliance with their legal and financial obligations. We also help employers understand and fulfill their obligations towards employees and workers, while helping them manage and mitigate possible risk and liability. Our lawyers can advise on stand-alone issues, or provide regular guidance throughout the lifetime of your venture. Reach out to us online or call us at (289) 652-9092 to schedule a confidential consultation with a member of our team.

Categories
Employment Law HR Consulting & Employment Law

Naloxone Kits Will Soon be Required in Certain Ontario Workplaces

On June 1, 2023, the Occupational Health and Safety Act will require certain Ontario workplaces to provide naloxone kits and train employees on how to use these kits. This blog post will tell you what you need to know about these new requirements.

What is naloxone and how is it used?

Naloxone is a medication that can temporarily reverse an opioid overdose, which includes opioids such as heroin, fentanyl, and some other prescription medications such as oxycodone. Naloxone is also known as “Narcan” which is a trade name.

Naloxone can be administered by either a nasal spray or an intramuscular injection.

Which workplaces will be required to provide naloxone kits?

Not all employers are required to provide naloxone kits and employee training under the Occupational Health and Safety Act amendments. An employer will be obligated to provide a naloxone kit when the employer is aware, or should reasonably be aware, that all three of the following factors are applicable to the workplace:

  1. There is a risk of an opioid overdose by a worker;
  2. There is a risk that the opioid overdose will occur in the workplace where that worker performs work for the employer; and
  3. The risk of overdose is posed by a worker who performs work for the employer.

The Ontario government has provided guidance on how an employer should assess these three factors.

There is a risk of opioid overdose by a worker

There are a variety of circumstances which should make an employer aware of a risk of an opioid overdose. Some examples of such circumstances are:

  • An opioid overdose has occurred in the past,
  • A worker has voluntarily disclosed opioid use to their employer,
  • An employer has observed opioid use among workers in the workplace or discovered such use,
  • An employer has found opioid paraphernalia (such as needles) in the workplace, or
  • Someone else has brought this risk to the attention of the employer, for instance, a human resources worker, the health and safety committee, or anyone else in the workplace.

The use of opioids by workers in the workplace as prescribed by a healthcare professional is not, on its own, sufficient evidence to create a risk of an overdose within the workplace.

If the employer is aware of a risk of an opioid overdose by a non-worker, such as a customer or member of the public, this requirement does not apply because the Occupational Health and Safety Act amendments solely target risks to workers within the workplace.

There is a risk that an opioid overdose will occur in the workplace where the worker performs work for the employer

These requirements only apply in the workplace. Therefore, an employer may be aware of a risk of a worker overdosing while not at the workplace (for instance, a worker could be on leave due to a substance use related problem), but this would not trigger the naloxone requirements of the Occupational Health and Safety Act.

The risk of overdose is posed by a worker who performs work for the employer

These requirements only apply to workers who perform work for the employer. Therefore, if there is an overdose risk posed by a worker of another employer, for example, on a job site with employees of multiple employers, these requirements would not apply.

What are the requirements around naloxone availability?

If an employer meets the criteria set out above and is required to provide access to naloxone in the workplace, that employer must provide at least one naloxone kit in each workplace that meets the criteria.

While the provincial requirement is only to provide one naloxone kit, employers are also required to take “every precaution reasonable” to protect workers under sections 25(2)(h) and 25.2(5) of the Occupational Health and Safety Act. Therefore, an employer may determine that providing more than one naloxone kit is necessary to meet this requirement, potentially due to a risk of multiple workers experiencing an opioid overdose at the workplace or due to the size of the workplace.

Specifications for workplace training

If a naloxone kit is required in the workplace, the employer must also ensure that whenever there are workers in the workplace, a trained worker is in charge of the kit and is working in the vicinity of the kit. That worker must have received training which meets certain requirements, including training to recognize an opioid overdose, administer naloxone, and be aware of the hazards of administering naloxone.

Employers must post the names and workplace locations of the workers who are trained to use the naloxone kits. This information must be easily visible and posted in an obvious place close to the location of the naloxone kit.

Employers must also ensure that their naloxone kits are maintained in good condition, stored properly and that no kits are expired. Further details related to the contents and maintenance of naloxone kits are found in Ontario Regulation 559/22: Naloxone Kits.

What training is available?

As of December 2022, Ontario’s Workplace Naloxone Program will provide free naloxone training and one free naloxone nasal spray kit to employers for a limited time. The Canadian Red Cross and St. John Ambulance are two organizations that are offering this free training.

While employers are required to train workers to use naloxone, they are not required to participate in a specific training course.

What consequences might an employer face for failing to comply with the new regulations?

If a workplace that is required to comply with these new requirements does not do so, the consequences of non-compliance can be up to $500,000 for an individual or supervisor, and up to $1.5 million for a corporation, director, or officer (per offence), including potential incarceration for up to 12 months.

What liability could be associated with administering naloxone in the workplace?

Generally, the protection from liability found in the Good Samaritan Act, 2001, would apply to someone who has administered naloxone within the workplace in the event of an opioid overdose. The Good Samaritan Act, 2001, in section 2, provides that:

“an individual … who provides emergency first aid assistance to a person who is ill, injured or unconscious as a result of an accident or other emergency, if the individual provides the assistance at the immediate scene of the accident or emergency” “is not liable for damages that result from the person’s negligence in acting or failing to act while providing the services, unless it is established that the damages were caused by the gross negligence of the person.”

Contact Mississauga Business Lawyers for Experienced Advice on Employment Standards and Human Resources Issues

The highly knowledgeable employment lawyers at Bader Law regularly assist business owners and entrepreneurs ensuring compliance with their legal and financial obligations towards employees and workers while managing possible risk and liability. We can advise on stand-alone employment law issues as they arise, or our trusted team can regularly guide and advise you throughout the duration of your venture. Contact us online or call us at (289) 652-9092 to find out more about how we can help you and your business.