Canadian Lawyer InHouse

MAY 2016 30 INHOUSE sel can fl ex their muscle around cybersecur- ity and mitigate risk, says Kroman, as well as advise on the necessity for cyber insurance, which is growing in popularity. THE BALANCING ACT OF GOING PUBLIC Bernier says it takes a fl exible personality to fi ll the in-house counsel role and navigate the opposing demands of the law and the interests of the corporation. "They have to be strong enough to enlighten senior management on the legal risk while balancing the commercial risk," she says. "In-house counsel must be able to provide senior management with the exact possible level of legal risk." Bernier says in-house counsel might be inclined to go public to mitigate legal ex- posure to the organization, while senior management is likely worried about manag- ing reputation. "Where it really comes to a head is breach notifi cation." It's a prime example of where legislation is changing. In-house counsel will have to prepare their organization, says Bernier. Last June, Canada passed into law Bill S-4 — The Digital Privacy Act, which makes a number of important amendments to the Personal Information Protection and Electronic Documents Act. One of the key changes was mandatory breach notifi ca- tion, so that under PIPEDA, organizations are required to give notice to the affected individuals and to the Offi ce of the Pri- vacy Commissioner of Canada about data breaches in certain circumstances. The changes in PIPEDA regarding man- datory breach notifi cation are similar to the existing common practice under Alberta privacy law, and since PIPEDA covers far more organizations and activities across Canada, the introduction of breach notifi - cation is expected to dramatically increase the number of notices in Canada. PIPEDA will require organizations to notify individuals, unless otherwise pro- hibited by law, and report to the commis- sioner all breaches where it is reasonable to believe that the breach creates a "real risk of signifi cant harm to the individual." The challenge for organizations and in- house counsel, says Bernier, is determining if there is a real risk and how to go about notifying affected individuals. The law does provide some parameters, she says, but, ul- timately, "in-house counsel must be part of the discussion because it is a legal standard." Any breach response policy should out- line who should be contacted and when, says Gratton. "There should already be a team in place." That team should include key people not only in information technology but also marketing and public relations. "You have to decide how you will notify people." Now- adays, it makes sense to have a social media expert to disseminate important informa- tion to affected customers, and if the organ- ization has a call centre, a script should be prepared for any questions that come in. It can be a challenge for an organization to identify a breach, says Gratton, but even if it thinks it has everything under control, being hasty can sometimes lead to deleted data and lost evidence, which can make the situation even harder to remediate. She recommends that in-house counsel bring in someone with cyber-forensics expertise. Because businesses operate almost exclu- sively on cyber-platforms, says Bernier, pro- INHOUSE For more information contact InHouse editor Jennifer Brown at jen.brown@thomsonreuters.com 11 th Annual General Counsel Roundtable This year the roundtable will be held in Toronto with fi ve general counsel who represent a variety of industry sectors. They share insights into managing the demands of the in-house role. Barbara Silverberg, Head of Legal, Dell Canada Robert Soccio, General Counsel, Corporate Secretary, Compliance Offi cer & Director of Human Resources, Navistar Canada Jason Young, Head of Legal, PayPal Canada Alena Thouin, General Counsel & Corporate Secretary, Alterna Savings Lara Speirs, General Counsel & Corporate Secretary, Randstad Canada Read it and watch video coverage online June 27 th at www.canadianlawyermag.com/inhouse COMING IN JULY 2016 Sponsored by

• Cover