A Guide to the GDPR in Canada

With most businesses going digital, more personal information is left vulnerable than ever before. The General Data Protection Regulation, or GDPR, was put in place to ensure private data stays private. The law covers national data across the EU and countries that sell to or interact online with EU citizens. That means that while the GDPR is an EU regulation, Canadians are still affected.

At MES Hybrid Document Systems, we work with Canadians across Ontario. We serve companies over a breadth of industries, supplying document scanning hardware, software, and business processing services. It’s important to us that our clients are in the know about safety and privacy laws, especially as you move your office online.

Here, we’ll provide a quick guide to GDPR, including data collection laws and the hefty fines for breaking them.

What is GDPR?

Personal data gets collected by businesses for many reasons. From email addresses to IP addresses, the information you absorb using cookies and forms is policed. In the EU, GDPR controls how companies use the personal information of data subjects. The data protection principles used guarantee these private details are managed lawfully, transparently, and fairly.

While GDPR is for EU residents, your Canadian company can be affected. All companies, even those outside of the EU, who sell services or products to EU residents fall into the jurisdiction of this law.

Basically, you must follow GDPR if:

• Your website collects cookies and IP addresses from visitors in the EU
• You live or work in the EU
• You sell goods or services to people in the EU
• Your business collects information from EU residents, and you process their data for clients
• Your website receives visitors from the EU

Rules Governing GDPR Compliance

No quick guide to GDPR is complete without a list of rules and risks. Some of the ways to comply with the regulation include:

• Record Keeping: When you handle data from any EU citizen, records must be kept ensuring ongoing compliance.
• Data Protection: A data protection officer and data controller must be appointed if companies are processing personal information on a grand scale.
• Storage Limitation: Data collected from EU citizens cannot be kept any longer than necessary.
• Required Consent: Before obtaining personal data from an EU resident, implicit consent must be given and maintained. An EU resident can withdraw consent as they see fit.
• Rights to Data: EU citizens have personal rights to their collected data. This means they can request the data be destroyed or sent elsewhere.
• Purpose Limitation: Use collected data only for the purpose it was collected for. Never share or reuse data for other purposes.

These are some of the more prominent regulations associated with the GDPR. Not following one or more of these could land you in trouble.

How to Protect Yourself

As companies begin relying more on digitization, how do you handle data? The business implications of GDPR require you to understand the overview of personal data as considered by the EU. This includes, but isn’t limited to data such as:

• Address and location
• Online identifiers (screen names, gamer tags, etc.)
• IP address
• Telephone number
• License plate
• Birthday
• Banking information
• Appearance

Each of these pieces of information is requested daily through online quizzes, contact forms, e-commerce checkouts, loyalty clubs, and even through social media. They’re also collected in tax forms, pay stubs, employment applications, sales receipts, invoices, newsletters, medical data collection, legal documents, and more. In fact, businesses across Canada collect much of this data without realizing it.

If a data breach occurs in relation to the GDPR, EU authorities must be notified within 72-hours. To avoid being reported on counts of a data breach, educate yourself on what signifies a breach, whether you’re covered under the GDPR in that breach, and be compliant when digitizing and collecting data.

Penalties for Breaching Regulations on Data Processing Activities

If your company is unsuccessful in complying with the GDPR, you could find yourself fined €20 million, or 4% of the global annual turnover. The highest rate between these two options is owed as a penalty. This is quite different compared to Canada’s Personal Information Protection and Electronic Documents Act, or PIPEDA. PIPEDA fines max out at $100,000 per violation.

Fortunately, the EU recognizes Canada’s PIPEDA as an equal standard for safeguarding data. This means data passed between Canada and the EU are accepted as meeting the same regulating guidelines.

Seek Professional Services

Bringing an office space out of the paper and filing cabinet age requires document scanning and digitization. If you’re looking to avoid penalization under the GDPR or PIPEDA regulations when converting personal information, it’s helpful to work with a professional scanning and business processing service.

At MES Hybrid Document Systems, we offer the best in document management software. If you’re looking for a quick guide to GDPR penalty avoidance, high-quality document management software goes a long way. This software stores, manages and helps you retrieve data after it is scanned and organized into your cloud storage.

Your software needs to handle all personal information carefully, ensuring it’s stored with passwords, encryption, and other privacy methods. Role-based security initiatives let only those designated to view certain files or images may open them. The software also provides business processing power, including sharing documents and sending reports.

Contact MES Hybrid Document Systems for More

MES Hybrid Document Systems has been working with businesses across Ontario for more than 50-years. After 5-decades serving Canadians, we’re still proud of the way we do with small, mid-sized, and large businesses across the province.

When we consider the GDPR and PIPEDA, we’re not only thinking about the privacy and safety of EU and Canadian residents. We’re thinking about the safety and wellbeing of our clients. It’s important to us that your business remains protected as your company grows and evolves.

Want to learn more about GDPR and how MES Hybrid Document Systems services help maintain these regulations? Give us a call at 1-905-475-9263 or visit us online.