Businesses within the Province of Quebec Have Homework to Do as to their Employees and their Data

As you may already know, Quebec’s Bill 64 was passed into law a couple of months back, setting in motion a substantial revamp of the province’s main privacy statute. Much like what’s been going on in Europe and, more recently, at Federal level, the province finally decided it was time to update its antiquated statute governing the protection of personal information within Quebec.

The law’s coming into force of an Act to modernize legislative provisions as regards the protection of personal information (the “Act”) will stretch until 2024. In the meantime, the first provisions of the new law came into force last week, including numerous new obligations for Quebec businesses and organizations about their employees.

In practice, until now, little attention was generally paid in Quebec as to rules that may govern and apply to the personal information of employees, an issue that was often swept under the rug. Well, now that the Act is here things have to change -fast.

Indeed, the Act provides for a whole slew of obligations that apply to employers within the province of Quebec. For example, as is the case elsewhere, Quebec organizations should draft and make generally available their data handling policy, including as to how you handle employee information. This is but an example of what the new regime requires.

The first thing quite a few Quebec businesses and organization should do, including relatively small ones, is come to terms with the fact that the world has indeed changed and that Quebec business may no longer look at privacy as this theoretical issue that no SMB really bothers with. With the advent of the Act, all businesses and organization should (quickly) make the transition, from apathy as to privacy, to being highly involved. If you need motivation to do so, the staggering amount of potential penalties provided by the Act should help: 25 MILLION dollars or, and here’s the kicker, 4% of annual revenues. Yup, that’s right, just like Europe did a while back, we’re now realizing that dollar amounts may not be enough, but percentage of revenues, now THAT scares the bejesus out of ANY business.

As to employees, without going into details, to start, you should probably simply understand that personal information is now treated as such, whether it relates to a customer or an employee. Both are individuals, right? So, from now on, the Act basically assumes that organizations should have processes, policies and protocols in place to deal with personal information, wherever it comes in or from -employee-related information including. One should also note as to these, that the Act now requires making these policies generally available, including to employees, so that individuals can know how you are handling their information. Though this may seem a no brainer, in actuality, quite a few Quebec organizations still do not comply with this.

The Act also provides constraints as to how an organization may use automated processing of data to make or reach decisions as to individuals. If your company has AI sorting CVs, for example, individual may have to be made aware of this fact, etc.

One should also make note of the fact that, no only must employees be made aware what information of theirs is collected and used (and how), but employees can now lodge complaints with the Quebec privacy watchdog called the Commission d’accès à l’information (the “CAI”), should they want to question the employer’s data-handling practices, for example, if they suspect their employer’s practices are not in-line with the Act.

As is the case in numerous other jurisdictions, the Act also now provides for a mandatory notification in case of hacking incidents (and similar incidents where personal information may have been compromised), including when it comes to employee information.

Another change mandates that employers (and all organizations in fact) appoint a privacy officer, who will handle personal information-related matters on behalf of the entity, moving forward. This will have to include issues relating to employee information. Such a person may, for example, be a an officer of the company and should, generally, be selected based on his/her ability to deal with eventual issues relating to the types of data that the organization at issue normally handles. In other words, though the Act presumes the president of the company may be the person in charge, he/she may or may not be the best person for the job. All in all, if you are located in the province of Quebec and have employees, you may very well now be subject to the new Act. The time to educate yourself, seek advice and act is… now.

Canada Updates its Competition Act

I recently became aware of changes to the Canadian Competition Act (the Act) meant to modernize this piece of legislation, including to give it a little more teeth.

The changes at issue include the following, in case you hadn’t been following this (I hadn’t):

  • The act now prohibits “drip-pricing” by on-line retailers, as it may be tantamount to false (or misleading) advertising. This is familiar to anyone who has shopped on-line where you may be drawn to a particular source offering a what seems like a good deal, until you go through the whole process and realize fees and costs are successively tacked on, so that you end-up with a price that is substantially more than the “price” that attracted you in the first place.
  • Speaking of false (or misleading) advertising, the recent changes to the Act now allow courts to impose penalties that are no longer limited to fixed (capped) amounts. From now on, whenever a judge must impose a penalty on a given business for this, (s)he may elect to set the penalty according either to what profit the business derived from its misdeed, or better yet, on a percentage (3%) of its annual global revenue. Do I have your attention now?
  • Likewise, the recent changes also remove the cap on competition-related criminal penalties, instead providing that judges now have discretion under the Act as to the amount of penalties imposed on wrongdoers.
  • Anti-poaching agreements between employers are now a big no-no, as an unacceptable constraint on the working conditions of Canadian employees by what amounts to a form of cartel. As to this, one has to admit, if you allow business to agree between them to refrain from hiring from competitors, you’re seriously limiting the prospects of employees working in that industry.

The changes at issue came into effect on June 22, 2022.

Canadian Court Cancels Trademark Registration Obtained in Bad Faith -a First

The 2019 changes to the Trademarks Act (the “TMA”) introduced a requirement that trademark applicants not file applications (nor obtain registrations) in “bad faith”. Though this has been part of Canadian trademark law for nearly 3 years, courts had yet to use the provision empowering them to cancel a trademark registration obtained in bad faith. This has now changed, thanks to a recent decision by the Federal Court, in Beijing Judian Restaurant Co. Ltd. v. Meng (2022 FC 743).

The case at issue basically stems from an individual becoming aware of a well known trademark, as used in China for restaurant services, and managing to secure a registration for that mark, before the actual owner really brought the mark to Canada. Yep, this is a story of good old fashion trademark piracy.

Fortunately for the good guys, given the 2019 additions to the TMA, brand owners now have a new tool with which to combat such high-handed attempts to squeeze and essentially defraud them. If they are reasonably quick, the first thing they can do, once a fraudulent application is advertised in Canada, is to oppose the application, based on the new ground of bad faith. Alternatively, if they fail to oppose and the mark actually gets registered by the bad guys, the real owner may attack the resulting registration, by relying on paragraph 18(1)(e) of the TMA, which now allows for cancellation of any registration that resulted from an application filed in bad faith.

In the case at issue, Mr. Meng filed the application at issue along with about 20 other applications reproducing famous marks relating to restaurants. Then, after securing actual registration, he contacted the legitimate Chinese business’ partners in Canada, and initiated what can only be described as a shakedown. Basically: you pay me or I sue you in Canada to stop your (legitimate) operations, because I now own a trademark registration for your mark -Ha ha ha [insert cartoon villain evil laugh here].

Well, too bad for this genius extortionist (alleged, should I say, right?), the TMA now allows us to cancel registrations like these, which is exactly what the real owner did, after refusing to pay the ransom, err, I mean the “price” which Mr. Meng asked for.

Given the portfolio of clearly fraudulent applications in his name and a request for 1.5 Millions dollars from this trademark pirate, the court had little difficulty finding bad faith here. Consequently, it ordered cancellation of the registration at issue.

As a result, we (at least) now have a first case of jurisprudence confirming that, yes, in clear cases of crass registration and extortion attempts, the new provisions of the TMA as to bad faith may be used to cancel a registration outright. As to other cases where facts will be less clear-cut, we’ll just have to see, including all eventual cases where pirates are not stupid enough to demand money outright and/or file tens of fraudulent applications in their own names.

For now, let’s just call it progress, and not dwell too much on the fact that this kind of situation now exists partly because the Canadian legislator, in its infinite wisdom, decided to do away with most rules relating to actual use, to file and register trademarks.