January

"The Canadian Province of Manitoba has enacted privacy legislation governing the collection, use and dissemination of personal information, including employee personal information. With the legislation, Manitoba joins the other Canadian Provinces of Quebec, Alberta, and British Columbia in providing special protection for employee personal data. Private-sector employers with operations in Manitoba should ensure their data collection and protection are in compliance with the Manitoba Personal Information Protection and Identity Theft Protection Act (PIPITPA), or risk fines of up to $100,000. Under PIPITPA, an organization must take care to ensure that ""personal information,"" defined as information about an identifiable individual, in its custody or under its control, may only be collected, used or disclosed with the permission of that individual. This includes personal information related to employees.

To that end, employers should designate a compliance officer to oversee the collection, use and dissemination of personal data, and must establish policies and procedures governing the employer 's handling of employee personal data. PIPITPA is still awaiting proclamation, which sets the date the legislation will come into force. Although no effective date has been set yet, employers are advised to begin planning for PIPITA as soon as possible."

"Starting November 30, 2013, British Columbia's government will waive the $20 criminal record check fee for not-for-profit organizations that participate in a program that also offers free expert advice. Under BC law, employers in the volunteer and not-for-profit sector must obtain criminal record checks for job and volunteer candidates if they will work with children or vulnerable adults.

The province's criminal record check program aims to alleviate the financial burden associated with the law. The current fee might seem like a small amount, but with mandatory checks for multiple job and volunteer candidates, it can quickly add up. For the program to continue to pay for itself, the fee for other organizations will increase to $28. In addition, the program will only waive the fee for provincial criminal record checks.

Employers will continue to pay for local or RCMP checks. Recent amendments to the Criminal Records Review Act also create ""portable criminal record checks."" Completed criminal record checks will be stored for five years, during which time a volunteer or job candidate may permit an employer to access the document. In theory, this will reduce redundant checks and save employers in the not-for-profit sector money when they recruit volunteers and employees. Criminal record checks that indicate a risk cannot be portable.

The stance adopted by the European Commission in the report on the functioning of Safe Harbor was probably one of the worst kept secrets of the privacy world. It was patently obvious to anyone close enough to the controversy around the ability of Safe Harbor to live up to the expectations of EU policymakers and regulators that the European Commission would be critical about it but would stop short of delivering a fatal blow to the scheme. So as expected, the commission's report unequivocally reveals some deficiencies that are seen as unfair for both U.S. companies, which properly apply the scheme and European companies that simply comply with EU data protection law. The toughest criticism is directed at the simple fact that, because the self-certification process does not involve any kind of regulatory scrutiny, about 10% of companies claiming to meet the Safe Harbor standards are actually making false claims. A more veiled criticism is directed to the enforcement mechanisms, which are seen as a little too lame by the commission. This translates into a very simple commercial point: Where a European company competes with a U.S. company operating under Safe Harbor, but in practice not applying its principles, the European company is at a competitive disadvantage in relation to that U.S. company. In the short term, this means that Safe Harbor will survive pretty much unscathed. In the longer term, this may even be the beginning of real interoperability of privacy approaches.