Quebec Law 25: Progress for Privacy & Challenges for Organizations

Hello and welcome to this next episode of Privacy
and Security Innovator Circle.
We are delighted to have two privacy pros,
uh, in this episode.
Both of these, um,
folks have written a very wonderful article in our privacy,
API Volume 2.0 book.
The article specifically addresses Quebec Law 25,
all the businesses that have been cramming
around figuring out what to do
and what not to do to get compliant, uh, with Quebec Law 25,
the deadline for which is actually approaching very quickly,
September, 2023.
They can get, uh, hugely huge benefits by reading the book,
reading the specific article.
And here Mark
and Kate, both of them are here to discuss
what they have written about, uh,
Quebec Law 25 in the articles.
So Mark and Kate, welcome to both of you.
And if you don't mind, why don't you go ahead
and introduce ourselves, maybe Mark first.
Sure. Mark Pilo, uh, VP of Sales for ITI
and, uh, well, VP of Sales
and Business Development for ITI across Canada
Data Point. I'm a lawyer,
uh, member of the bar of Quebec.
I've been working with ITI for just over a year
and I'm the privacy officer of my organization.
Wonderful. Thank you so much, Kate. Thanks, mark.
So I'm curious, you know, a lot of organizations in Quebec
and of course elsewhere as well, uh, they're realizing
that they need to get compliant
with the privacy compliance law, Quebec Law 25.
And, you know, willy nilly, they are sometimes designating
people to become data, uh, privacy officers
or privacy in charge
or privacy manager for their organizations.
And I really actually seen a number of folks who,
who just designated privacy officers
and they, they're wondering what to do, what does it entail
to become a privacy officer or be designated as the DPO.
So, may I request you first to start with, you know,
what would be a kind of a 30, 60, 90 day plan
for individuals who just, you know, won the lottery
and the jackpot
and got designated at privacy offices by the organizations?
So, so I'm gonna let Kate jump in here in a second
'cause she's really gonna be, uh,
have more relevant information on that.
But, so I can tell you from speaking to a lot of customers,
nobody seems to have a common way of doing things today.
And the 30, 60, 90 days really depends when we get involved
with them and how far they are down that.
But the, the result of what's happened
with this truncated timeline that that's being announced is
that nobody seems to have figured it out
or has the common playbook.
So I think where we're gonna focus on, on kind
of helping our customers
and what Kate's gonna share with you in a second is, is
how we address it internally.
'cause we are a Quebec based company,
so we have the same restrictions
and we had to figure this out as well.
Obviously we have a few more benefits than other people have
access to around technology expertise.
So, you know, we're trying to do our best,
but I'll, I'll leave it to Kate to kind
of talk about her journey
and how she came up with her 30 69, if that makes sense.
Yeah. So, uh, first thing I would say,
so depending on the role
of the privacy officer in the organization, for me,
I'm a lawyer so I know, uh, a little bit more,
but, um, privacy officer, they need to educate themselves
to know what the new obligations are
and what the timeline is for, uh, implementation.
I think it's the main goal, uh, to know
what the new requirements are.
So that's the first thing to do.
Second, they need to gather a team to help, uh,
with the compliance, hr, it, finance and executives.
They need to be involved in this process
because it's really teamwork.
The privacy officer can do it alone for sure.
And I think it's really important to do an inventory
of the personal data you have and where is it.
So I think it's really important
to work those three steps to, to start.
Wonderful, wonderful.
And I was making some notes, Kate,
and that itself could become another article by the way.
Uh, what you're saying is, look, don't go it alone.
Don't be the hero just trying to do it all alone.
Gather your team, get exactly by
and help them understand why this is important.
Understand the timelines, uh, involved over there
because you don't have a lot of time,
unfortunately right now.
And start with a PII inventory, right?
So the great, great, great points, great points there.
Mark, I'll come to you.
As you stated, you had business development at ITI you work
with a lot of organizations
and a number of those organizations probably are very small,
but growing very fast.
What I have seen is, as smaller organizations, we tend
to give a short shift to privacy compliance
and sometimes insecurity not good,
but you know, that's reality of life.
The problem with smaller organizations is
that they don't have a lot of time,
they don't have a lot of resources.
They don't have people to just, you know,
who will handle a particular topic.
A person is doing 10 different things.
So from that lens,
and in that context, if you were to advise smaller
but growing organizations to say, Hey,
I understand you don't have time and resources,
but you know, you probably need to take care
of a few easy things
that will give you an amazing ROI
as your organizations continues to grow in the area
of privacy and compliance,
I'm curious to hear thoughts about that.
What would those some easy things be? Well,
Before we get to the easy things, let's just go back
to the challenge for two seconds, right?
So, you know, especially when you're a smaller organization,
the amount of resources from a people standpoint
and knowledge is very limited, right?
Like, your number one goal is to grow.
And it's, these laws come into fact that they kind
of put a little bit of a monkey wretch in there
because you're, you're growing over time.
So I would say understanding where things are at
before you take action is the best ROI you can have.
So, uh, taking, as me Kate mentioned, getting an inventory
of where you are kind of going off the rails
before taking action will mean the most
to the smaller organizations.
'cause you're not gonna waste time in the,
I don't wanna say like, you know, traditionally,
if you look at the privacy companies that exist for,
for consulting, what we've seen is there's a lot of surveys
and people have to know their environment.
The challenge is, is when you're in a smaller organization
growing, you don't know it.
So you kind of run all over the place.
You get surveys answered.
In the end, it might not mean as much as you think,
and I'll tell, I'll use the example of email.
Email is the constant thing where we find
that people are using it in the wrong way.
They're sharing documents they shouldn't share,
they're sharing pieces of PII
to just get something simple done at the speed
of the business, but causes a major
compliance issue afterwards.
So I'd say that the, the quick hits would be understanding
your current layout, like where,
where you're having problems,
how people are using applications, um,
and where they might be going off,
focusing on awareness within the organization
to make sure they understand how they can share
and where things should be shared.
And lastly, uh, we do a lot
of different SharePoint projects, M 365 projects.
We do a lot of broad, there are guardrails
that can be set up and you need to speak to somebody
that can help you set up those guardrails
and then make everybody aware within the different business
units on what's there and how to leverage it.
The better that we do this, like the better way
that we go about attacking it
and making sure everybody's on board
to understand the repercussions
of what happens when we don't.
I think we're gonna get somewhere
where the return on the our,
on their investment's gonna be a lot better,
a lot faster instead of trying to, you know,
re-architect everything afterwards.
Got you. Got you. Wonderful, wonderful.
So, and I said there's a, there's a nice, uh, parallel
between what you just spoke
and what Kate was talking about in the previous, in response
to the previous question, which is,
you know, don't do it alone.
Get some help, seek help.
Now what you're saying is help might be available not only
inside of your organization, but also outside.
There are, you know, consultants, there are people,
you know, uh, ITI has a number of people, number
of consultants who have been doing this
for quite some time actually.
And so seek help
and you know, you know, you know, it might even be surprise,
and I'm not going to say this,
but you know, I, I'll still say this a little bit,
it might even surprise us
as do people are actually willing to help.
You know, don't worry about the
commercial considerations just yet.
Uh, privacy is a shared benefit for everyone in the society.
So I think that people are willing to help.
At least I have seen that.
Kate, any uh, further points that you would like to add?
Um, as advice to smaller yet growing organizations?
Uh, no, I agree with Mark.
It's important to educate employee as well,
because they don't know their requirements.
They don't know necessarily what to do, what's wrong.
So it's really important to do that as well.
Got you. Educate employees. That's a really good one.
Let me start, uh, this question with you, Kate, actually,
which is, uh, you know,
and we'll go, uh, on the topic about seeking help, um,
internally and also externally.
Now, ITI is has been helping
the community and businesses for a very long time.
I would love for you to talk about, uh, a little bit
and then we'll go to Mark about what kind of help can
the community, uh, expect, you know, to
as they approach ITI, uh,
and ITI consultants specifically with respect to compliance
with Quebec Law 25.
Yeah, we have a great team at ITI that can help, um,
the community and the, we have a lot of specialists, um,
that can help with the, as mark said, SharePoint.
Um, so I think we can really help with that.
But Mark, if you wanna go, um,
maybe you have more answer to that question.
So, Kate, Kate, you know, as far as our, uh,
being our privacy officer, uh,
having a law background I find extremely valuable.
So, like Kate's an example of a resource that, you know,
it's typically not something that would be customer facing
for us, but that is all he was willing
to pitch in and help out.
So because of the way that the law kind of came about,
and it's not really on the Canadian level, still waiting
for 27 to be approved, there's different restrictions.
If you look at the Quebec law came in so fast
and so furious, we would say that, you know,
we are leveraging talent from all different aspects.
So Kate is one aspect of, of, of somebody that we'll ping
to speak to our customers at our events
and different things on her challenges
and how she sees it rolling out.
But then from our standpoint,
how we're helping the communicate, uh,
community is helping them understand that, you know,
you're not gonna have all the answers day one.
And you need to reach out to multiple different people
to get their opinions as well,
to start formulating a plan to move forward.
And before you get into some long-winded,
especially when we talk about the medium businesses
and the growing businesses,
before you get into a, a, a big, long-winded, um, mandate
with a firm that specialize in this, let's know
how bad the problem is first,
or where maybe you have some issues
that can be remediated before you get there.
Because if, if the scope is this big,
but the problem's this big, you're gonna over spend.
So when we talk about discovery, that's where I think, um,
the expertise that we have being helping customer
for 30 years really helps out.
'cause not only understanding how data shared,
where it's stored cloud infrastructure,
on-prem infrastructure applications, how teams works, um,
we have a lot of information we can, we can help customers
with, but we're not alone.
There's tons of people across the industry that can, I think
that's where we've taken, um, an approach
of let's educate our customers, let's bring them forward.
Contributing to this, uh, ebook was a, a great honor
for us to help out.
And I think, um, as long
as everybody keeps on sharing best practices,
we're gonna get to something that looks more efficient than
what traditionally has been done.
Wonderful, wonderful.
So don't just go about and jump onto the problem right away.
Do let's get, you know, some help on discovery assessment
or how big is the problem?
Uh, for example, I I, I was hoping,
and I love that you volunteered Kate as it's privacy officer
to, you know, who's, who can actually help, uh, people,
uh, who are approaching you.
And I'll tell you why I love it
because at Lightbeam we have actually done the same thing.
Our privacy, uh, chief privacy officer, a gentleman
by the name of Bill Shaman, uh,
he has been actually doing the same thing.
He is helping customers, helping them out with, you know,
what is the gap, you know, and how, what's the next step?
So I love that. Uh, well it has been a pleasure talking
to both of you, and I cannot thank you enough for
not only talking to me today,
but also taking the time
to write the article about Quebec Law 25 in the book.
The uptake of that, from what I can tell,
has been phenomenal.
Quebec Law 25, a lot of organizations are actually, uh,
obviously justifiably worried about what to do.
The September 23 deadline is just, you know, marching,
um, like there's no tomorrow.
And so just these tidbits
of information help has been hugely helpful.
I look forward to welcoming you
to my next Privacy Pro podcast at a future time.
But until then, thank you so much.
Um, Kate and Mark, thanks Pete. Thank
You. Pleasure.