Checklist for wealth managers to meet Canada’s privacy laws

31 Aug Checklist for wealth managers to meet Canada’s privacy laws

With the introduction of new federal and provincial laws, Canada is entering a new era of privacy protection. Investment firms and financial institutions now have to shift gears, review rapidly, and in many cases, completely overhaul how they collect, store, and use their customers’ data. Here’s a checklist to ensure you’re prepared.

Tech adoption has been growing exponentially over the past decade, enabling companies across industries to capitalize on customer data. Firms use it aggressively to understand consumers’ pain points and unmet needs, develop new products and services, personalize advertising and marketing, and improve consumer engagement.

However, recent history shows that consumer data is subject to hacks and breaches. Identity theft has become all too common. In response, governments have begun to amend legislation to hold companies accountable for keeping this data safe.

“Any companies that collect, use and store personal information must comply with the law. Wealth management firms are no exception. To do so, they will have to provide their staff with the protocols and tools they need to properly manage the life cycle of any personal information they obtain from their clients,” said Luc Larose, Lawyer and Vice-President of Client Experience at Croesus.

New Canadian privacy acts

On September 22, 2021, the Québec government adopted Bill 64. It is now known as Law 25, An Act to modernize legislative provisions as regards the protection of personal information. The provisions of this Law will gradually come into force until September 2024. This reform makes Québec the first Canadian province to modernize its personal information protection policies to meet the current technological reality.

Many businesses may assume that the new legislative provisions do not apply to them. However, the reality is that any company that does business in the province will be subject to the new regulations.

“It’s important to comply with the Law promptly and on time because the organizational changes required will require a significant amount of planning, time, and resources. What’s more, the financial penalties for failing to comply are considerable,” said Larose.

Québec is not the only one tightening the privacy and data protection rules. Canada is quickly following suit with the tabling of Canada’s Consumer Privacy Protection Act. Although Bill C-27 may be significantly amended as it works through the legislative process, it is perfectly aligned with a growing trend towards privacy. The new privacy act of Canada aims to offer more robust protection locally and internationally.

Checklist to meet new Canadian privacy laws

For firms and banks in Canada to effectively navigate the complex new privacy regulations, it’s essential to understand what the new provisions stipulate. These institutions need to understand what they are allowed or not to do. It’s also critical for businesses to be clear on what implications are involved with non-compliance.

“Financial professionals and firms will have to ensure that the collection, use, disclosure, retention, and destruction of personal information are properly supervised,” said Larose.

Below is a checklist of actions you should already have taken to comply with the new provisions.

• Access to Information and Privacy Committee: Establish data governance processes, including mechanisms to facilitate individuals in exercising their new-found privacy rights.
• Privacy Officer: Appoint an individual responsible for ensuring adherence to privacy legislation.
• Breach notification: Mandate the reporting of any unauthorized access to personal information to both the affected person and the Commission d’accès à l’information (CAI) (Access to Information Commission).
• Enhanced regulation for research or statistical data: Implement a more rigorous framework for the disclosure of personal information for research or statistical purposes.
• Formulation of corporate data management policies: Develop policies for managing corporate data effectively.
• Transparency requirements: Publish privacy regulations and policies, and provide relevant information to affected individuals concerning various privacy-related matters.
• Internal guidelines for implementation: Create internal guidelines to support staff and service providers in the implementation of new privacy policies.
• De-indexing solutions: Utilize technological solutions to de-index or transfer personal information upon the request of the person concerned.
• Strengthened consent rules: Implement more stringent rules for obtaining consent.
• Revised conditions for data collection and disclosure: Introduce new criteria for collecting and disclosing personal information in diverse contexts.

In 2024, the right to data portability will be added to the list.

These rules apply not only to you, but also to your service providers. To avoid finding yourself in a disastrous situation that jeopardizes your business, it’s important to choose your technology suppliers wisely.