From Regulations to Solutions

Day One: Tuesday, March 6, 2007

8:45am – 9:00am

Welcome & Introductions

Speaker(s):
Chairperson: Murray Long, President, Murray Long & Associates


Speaker(s):

Chairperson: Murray Long, President, Murray Long & Associates

Mr. Long has provided guidance on compliance to organizations in telecommunications, banking and insurance, transportation, retailing, healthcare, employment privacy, and charities. As a member of the Canadian Standards Association (CSA) Privacy Committee, he helped draft the CSA Model Code for the Protection of Personal Information, which formed the basis for the Personal Information Protection and Electronic Documents Act (PIPEDA) and subsequent provincial laws.

As the principal or co-author, some of Murray's publications include:
- Making the CSA Privacy Code Work for You (1996)
- Canadian Privacy Law Handbook (2000)
- 400-page CD ROM-based training tool for the CSA. (2002)
- Comparison of PIPEDA with Provincial Privacy Laws (2005)
- Your Payroll Privacy Questions Answered (2005)

In January 1997, he started his own consulting practice. A key early assignment was conducting a review of all of the submissions received by Industry Canada on its consultation process on new privacy legislation and co-authoring the Summary Report on these responses, published by Industry Canada in July 1998.

9:00am – 9:40am

SPECIAL PRESENTATION!

The PIPEDA Review & Trend Analysis of the submissions made.

Speaker(s):
Hon. Tom Wappel, MP Scarborough Southwest & Chairman, House of Commons Standing Committee on Access to Information, Privacy & Ethics


Speaker(s):

Hon. Tom Wappel, MP Scarborough Southwest & Chairman, House of Commons Standing Committee on Access to Information, Privacy & Ethics

9:40am – 10:00am

Question Period


10:00am – 10:45am

Facilitated Roundtable Discussion

This session is dedicated to providing delegates the forum to discuss what they feel are the key issues that will impact organizations, while networking with their colleagues in a relaxed setting.

This session is dedicated to providing delegates the forum to discuss what they feel are the key issues that will impact organizations, while networking with their colleagues in a relaxed setting.

10:45am – 11:15am

Refreshment & Networking Break


11:15am – 12:00pm

Measuring the Impact on Service Providers - Panel

This session is dedicated to identifying the potential impact on organizations whose primary business is delivering a service.

Speaker(s):
Gabe Mazzarolo, CPO, Workopolis
Jeff Green, CPO, RBC
Yim Chan, CPO, IBM

There are different types of Service Providers. The type of client served, the type of information handled and the level of access to that information all help to define a Service Provider. The impact privacy legislation has on a Service Provider, differs depending on whether the organization provides services directly to individuals or whether it provides services on behalf of another organization or both. The members of this panel will discuss the impact the legislation has on their particular organization and any privacy related issues.

Speaker(s):

Gabe Mazzarolo, CPO, Workopolis

A technology leader with over 15 years in the industry, Gabe has been an advocate for Technology and utilizes technology to drive business results. As Vice-President of Technology and Chief Privacy Officer, Gabe has dual responsibility for all ongoing development of Workopolis products including: workopolis.com, workopolisCampus.com and CorporateWorks and the ongoing maintenance, education and enforcement of the stringent Workopolis privacy policy. This enables Gabe to ensure that the privacy requirements of Workopolis are embedded into every aspect of its business processes. The Workopolis privacy policy was rated number 1 in the consumer services category for transparency in the 2006 Top Privacy Policies in Canada by Nymity Inc.

Jeff Green, CPO, RBC

Mr. Green is Chief Privacy Officer and Head of Global Privacy & Information Risk Management at RBC Financial Group, and he is part of RBC's Group Risk Management function. He is responsible for integrated enterprise-wide privacy and information risk management for Royal Bank of Canada and its operating subsidiaries under the Canadian Bank Act, other governing legislation and other applicable laws and regulations, globally. Born in Montreal, Quebec, and a graduate of the University of Toronto, Mr. Green has held increasing leadership roles with RBC for over 20 years, and in 2003, Mr. Green became Vice President at RBC Investments, with responsibility for the operational risk, risk policy, fraud management, Anti-Money Laundering, and Privacy Management programs for RBC Investments' businesses globally. He was appointed Chief Privacy Officer in November 2004, and to his current position in October 2006.

Yim Chan, CPO, IBM

Yim Chan is the Global Privacy Executive for the IBM Corporation as well as the Chief Privacy Officer (CPO) for IBM Canada. Her responsibilities include developing and implementing programs at the enterprise level for IBM's global privacy management system and embedding privacy into relevant business processes. In her capacity as the CPO for IBM Canada, Yim is responsible for guiding information handling policies and practices across IBM Canada. Managing both roles reflects the increasing complexity of the privacy requirements demanded of globally-integrated organizations such as IBM and the steps that must be taken to maintain recognition as a technology and business leader.

12:00pm – 1:00pm

Networking Lunch


1:00pm – 1:40pm

An Examination of Quebec's Recent Bill 86

Does your organization do business in Quebec? Learn the ins and outs of Quebec's very own Private Sector privacy legislation.

Speaker(s):
Karl Delwaide, Lawyer, Fasken Martineau LLP (Montreal)

Does your organization do business in Quebec? Learn the ins and outs of Quebec's very own Private Sector privacy legislation. This session will examine the thinking that went into Bill 86, why it is important to Quebec and Canada as a whole, what makes Bill 86 unique from other private sector privacy legislation...and finally what impact this will have on organizations operating in or doing business in Quebec.

Speaker(s):

Karl Delwaide, Lawyer, Fasken Martineau LLP (Montreal)

KARL DELWAIDE, a partner at Fasken Martineau DuMoulin LLP, has acquired a solid expertise on issues relating to the protection of information held or managed by an organization, whether financial, commercial or strategic information regarding an organization or its clients, as well as the protection of privacy and of personal information, including its use on the Internet. Mr. Delwaide has acted regularly in these matters before the "Commission d'acces a l'information" and other tribunals or courts, such as the Federal Court, for public organizations or private enterprises. He is well known as being among the very few Quebec lawyers with extensive experience and knowledge of the Courts and Tribunals in this field. Mr. Delwaide is one of the founders and a member of the National Practice Group on Privacy and Information Protection of Fasken Martineau. He is moreover the Chair of this group. He is also the partner appointed as Chief Privacy Officer for Fasken Martineau nationally. Finally, he is one of the author of the book published by the Office of the Federal Privacy Commissioner in August 2005, entitled Learning from a decade of experience: Quebec's Private Sector Privacy Act.
http://www.privcom.gc.ca/results_e.asp?ss=learning+from+a+decade&lg=e&rc=1

1:40pm – 2:00pm

Question Period


2:00pm – 2:45pm

Responding To & Preventing Breaches

Any good privacy breach prevention policy will include a strategy for responding to breaches if one occurs.

Speaker(s):
Terry McQuay, President, Nymity
Robin Gould-Soil, CPO, TD Financial

Breach notification is costly and likely to become a legislative requirement. This session addresses:
* How organizations can eliminate privacy breaches with effective policies, procedures and employee education
* When to provide breach notification, and when breach notification is unnecessary
* Best-practices to minimize negative impact to an organization when breach notification is required

In light of recent highly publicized privacy breaches, this session promises to be informative and timely.

Speaker(s):

Terry McQuay, President, Nymity

Terry McQuay is the founder and President of Nymity Inc. Mr. McQuay is the Canadian Co-Chair of the International Association of Privacy Professionals' KnowledgeNet and a Certified Information Privacy Professional (CIPP & CIPP/C). He is on the Canadian Marketing Association's Ethics and Privacy Committee, a Privacy Advisor to the Canadian Standards Association(CSA) and a Privacy Trainer for the Canadian Institute of Chartered Accountants(CICA), Privacy Advisor for the Retail Council of Canada.

Mr. McQuay is one of Canada's leading authorities on privacy risk management and oversees the development of Nymity's premier privacy risk management support program called PrivaWorks. Also, for the last four years he has developed and delivered privacy training to hundreds of organizations making him the leading privacy educator in Canada. Learn more by visiting www.nymity.com .

Robin Gould-Soil, CPO, TD Financial

Robin Gould-Soil is the Corporate Privacy Officer at TD Bank Financial Group, a position she has held since November 2000. In this role, she is charged with overseeing the development and execution of the Bank's corporate privacy strategy as well as that of its insurance, securities and other subsidiaries in Canada. Robin is a executive member of the Canadian Chief Privacy Officers' Association, a Canadian advisory member for the IAPP and a member at the Canadian Bankers Association's privacy specialist group.

2:45pm – 3:15pm

Refreshment & Networking Break


3:15pm – 4:00pm

Applying Metrics to Your Privacy Program

Speaker(s):
Tony Power, CPO, Bell Aliant

Measuring performance can be a very challenging task, especially when success isn't directly tied to profitability. However if it is effectively and appropriately done, it can be one of the most valuable exercises an organization can go through. Measuring an organization's privacy performance provides no exception, in fact it may even be more challenging given that so few organizations have done it and proven methods are difficult to come by. The privacy team at Bell Aliant has done it. By adapting the Privacy Diagnostic Tool, developed by Ann Cavoukian and her staff at the Office of the Information and Privacy Commissioner of Ontario, Bell Aliant has developed a metrics based approach that enables it to measure if their privacy program is meeting objectives. Join the CPO of Bell Aliant, Tony Power, as he discusses:
* Bell Aliant's own privacy journey
* Illustrating the importance of performance measurement
* Quantitative versus qualitative, understanding the metrics
* Developing a privacy metrics program that works for you

Speaker(s):

Tony Power, CPO, Bell Aliant

Mr. Power is Chief Privacy Officer and head of Corporate security at Bell Aliant Regional Communications, LP. He is responsible for corporate wide privacy and security risk management for Bell Aliant and its operating subsidiaries. Born in St. John's, NL and is currently based in Halifax, NS, Mr. Power has held various technology and management roles with Bell Aliant and its predecessor companies over his 8 years,and to his current position in 2005.

4:00pm – 4:00pm

End of Day


Day Two: Wednesday, March 7, 2007

8:45am – 9:00am

Welcome & Introductions

Speaker(s):
Chairperson: Murray Long, President, Murray Long & Associates


Speaker(s):

Chairperson: Murray Long, President, Murray Long & Associates

9:00am – 9:45am

The World of Privacy: Past, Present, & Future

Keynote Presentation!

Speaker(s):
Heather Black, Assistant Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Over the past twenty years much has changed: TV's are bigger and better, gas prices are up, and home appliances virtually run themselves. The technology we use to conduct our businesses has changed not only the way we do business but the way we view the world...or is it more accurate to say technology has changed how the world views individuals?

It goes without saying that new technologies have greatly improved both internal and external operations for many organizations, but it has also brought about many risks not the least of which are privacy risks. This presentation will take a two-fold approach to examining these privacy risks. First it will look at the "World of Privacy" and how it has changed over the past twenty years. Second, this presentation will examine how the privacy landscape may look twenty years from now if we continue to experience change at such a fascinating rate.

Speaker(s):

Heather Black, Assistant Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Heather Black is a former member of the Department of Justice, where her practice was largely in commercial law. From 2001 to August 2003 she was General Counsel at the Office of the Privacy Commissioner of Canada. In August 2003 she was appointed Assistant Privacy Commissioner of Canada with primary responsibility for private sector privacy.
Ms. Black first began working with privacy issues as a member of the Information Law and Privacy Group at Justice from 1982 - 1986 where she participated in the drafting of guidelines for the implementation of the Privacy Act, provided legal advice on its interpretation, and litigation support on Privacy Act cases.
Ms. Black is a graduate in English from Concordia University (1965) and has an LLB from McGill University (1974). She was called to the Ontario bar in 1976 and practised with the Department of Justice in various capacities until 2000.
As counsel to Industry Canada she worked on the development of Part 1 of the Personal Information Protection and Electronic Documents Act. She was involved in the policy development and was instructing counsel on the drafting of the Bill.
She is a co-author of "The Personal Information and Electronic Documents Act: An annotated Guide" published by Irwin Law (Perrin, Black, Flaherty and Rankin) www.irwinlaw.com

9:45am – 10:45am

Privacy in a Global Environment

Speaker(s):
Joe Alhadeff, CPO, Oracle
Richard Simpson, Director General, Industry Canada

Transborder data flows (TBDF) refer generally to the transfer of personal information between jurisdictions. TBDF occur not only between organizations, but also frequently within organizations as well. The growing significance of TBDF can be attributed primarily to two factors; the rapid development in information communications technologies, and the liberalization of trade in services. What can we do? Complex problems require sophisticated solutions. Some point to PIPEDA as the problem, and argue that we need to fix it. However, PIPEDA is not broken. Rather, the potential threats to personal information in foreign jurisdictions reflect the fact that national laws have limited reach beyond their borders. This presentation will highlight the issues raised by global environment, but also what is happening around the world with respect to these issues.

Speaker(s):

Joe Alhadeff, CPO, Oracle

As Chief Privacy Officer (CPO) and vice president for global public policy at Oracle Corporation, Joseph (Joe) Alhadeff oversees Oracle's privacy program to ensure protection of personal information across all Oracle operations and product areas. In addition to his role at Oracle, Mr. Alhadeff serves a prominent role in several influential international organizations dedicated to Internet policy, security and privacy. Mr Alhadeff serves as the BIAC Vice Chair to the OECD ICCP Committee, head of industry delegation to the OECD Security Steering Group, and a Vice Chair of the International Chamber of Commerce's Electronic Business and Information Technology Committee. In the US, Mr. Alhadeff chairs the Internet Law and Policy Forum, the Information Technology Committee for the US India Business Council and Government Affairs Committee for the Software and Information Industry Association, and co-chairs the USCIB's E-Business Committee.

Richard Simpson, Director General, Industry Canada

Mr. Richard Simpson has worked in the field of communications and information technology for more than 25 years, occupying senior executive positions at the national and international levels. He is currently the Director General, Electronic Commerce with Industry Canada, and is responsible for the development and implementation of Canada's electronic commerce strategy at the domestic and international levels. His current responsibilities include Canada's policies towards privacy protection, electronic authentication and online identity management, and measures to combat spam, spyware and related threats to the Internet and online commerce. He has also played a leading role in Internet policy work at the international level, having chaired the OECD's Working Group on the Information Economy, as well as the UN ICT Task Force's Working Party on ICT Indicators and MDG Mapping. He played a prominent role in the work of the G8 DOT Force, which reported to G8 Leaders at their Summit in Kananaskis in June 2002.

10:45am – 11:15am

Refreshment & Networking Break


11:15am – 12:00pm

Facilitated Roundtable Discussions

This session is dedicated to providing delegates the forum to discuss what they feel are the key issues that will impact organizations, while networking with their colleagues in a relaxed setting.

This session is dedicated to providing delegates the forum to discuss what they feel are the key issues that will impact organizations, while networking with their colleagues in a relaxed setting.

12:00pm – 1:00pm

Networking Lunch


1:00pm – 1:45pm

Best Practices From Banking/Finance

Speaker(s):
Johnna Koso, Director Privacy, BMO Financial Group

Financial institutions (FIs) have great expectations placed on them from both customers and regulators, and with good reason. It could be argued that (FIs) deal with some of the most sensitive information about an individual or business that can be had. With that in mind, this presentation will focus on practical matters the Privacy Team at BMO has worked through and the top issues privacy professionals face today. Topics for discussion will be based on experiences with:
* Developing a privacy program in a multi-national corporation that has to deal with a variety of regulations, a myriad of businesses and a company that's expanding
* Managing diverse incidents and complaints
* Monitoring of issues and the resolution of those issues
* Watching what happens to others, not only other FIs, but companies in other industries and in other jurisdictions.

Speaker(s):

Johnna Koso, Director Privacy, BMO Financial Group

Reporting to the Chief Privacy Officer, Johnna has responsibility for BMO Financial Group's Privacy Offices in Canada and the U.S. She is accountable for promoting best practices in personal information management and ensuring compliance with the legislative requirements. Johnna has 17 years of experience in the financial services industry, 12 of which have been with BMO Financial Group. While at BMO Financial Group she has held positions in Corporate Audit and Electronic Services. Prior to that time she was a National Bank Examiner with the Office of the Comptroller of the Currency. Johnna has a B.S. in Finance and Marketing from the University of Nebraska-Lincoln and an MBA with honors in Entrepreneurship from DePaul University.

1:45pm – 2:30pm

Acceptable Employee Monitoring

Speaker(s):
Debbie Bennett, President, HRPAO
Ben Tarnow, Human Resources, Crown Packaging
Kris Klein, Litigation Counsel, Office of the Privacy Commissioner of Canada

Crown Packaging is a Western Canadian based manufacturing company with over 450 employees across 3 plants, 2 of which are unionized. In 2005 (at its non-unionized Calgary, Alberta facility) and 2006 (at its unionized Richmond, BC facility), Crown Packaging introduced the RSI Hand Punch, a technology that uses hand geometry (a form of biometric technology) as way to identify employees as they "punch in" to work. This system has generated a number of challenges for Crown Packaging. This presentation will examine some of the challenges faced by Crown, while examining the greater issues surrounding employee monitoring from an organizational & privacy perspective.

Speaker(s):

Debbie Bennett, President, HRPAO

As an HR practitioner dedicated to the profession, Debbie Bennett, CHRP, currently serves as Vice Chair of HRPAO, having previously served for three years as Chair of the Professional Standards Committee where she was instrumental in the adoption of national standards. Debbie chairs the Governance Task Force and regularly attends the meetings of the Audit and Finance Committee. She is a past member of the Education Standards Committee and the Federal Government Affairs Committee. Debbie has over 20 years of progressive experience in human resources. In her current position as Vice-President, Human Resources and Finance, she is a key player on the Executive Committee of the Ottawa Citizen, influencing decisions important to the future of the company. Debbie holds a Bachelor of Commerce (Honours), a Bachelor of Arts (Minor - Economics) and a Master of Industrial Relations from Queen's University in Kingston. She also has an eight-year-old daughter.

Ben Tarnow, Human Resources, Crown Packaging

Ben's career at Crown Packaging commenced at the same time a new employee-monitoring system, the RSI Hand Punch, was implemented at Crown's Richmond, British Columbia facility. A significant portion of his job description is to oversee the administration of the RSI Hand Punch in the unionized Richmond facility. Asides from that, Ben's duties at Crown include assisting with the grievance handling procedure, maintaining an effective performance management system, and providing labour relations advice to Management employees at Crown's unionized facilities. Prior to working at Crown, Ben received his Master of Industrial Relations and Human Resources from the University of Toronto in 2005 after completing his Bachelor of Arts in Industrial Relations at McGill University in 2004.

Kris Klein, Litigation Counsel, Office of the Privacy Commissioner of Canada

Kris Klein practices exclusively in the area of privacy law for the Privacy Commissioner of Canada. Mr. Klein previously practiced with a national law firm and the Federal Department of Justice. He teaches the Privacy Law course at Ottawa University's Law School and he has written extensively on this subject, including co-authoring "Bill C-6: A New Privacy Paradigm," and "Power Privacy Legislation Makes Businesses Accountable." Mr. Klein's experience in both the private and public sectors provides a particularly insightful and practical analysis found in his texts: "The Law of Privacy in Canada" and "Privacy in Employment: Control of Personal Information in the Workplace."

2:30pm – 3:00pm

Refreshment & Networking Break


3:00pm – 3:45pm

Examining the Relationship Between Privacy Compliance & Information Management

Speaker(s):
Sandra Smith-Frampton, Corporate Privacy Officer, ATB Financial

"Privacy Compliance" is more than just adhering to legislation.
Did you know that the cornerstone of compliance can be established by identifying and managing personal information stores in your organization? There are legal requirements that dictate certain information must be retained for specified periods of time, but how do you protect information you may not know you have, especially when its personal information that may be subject to review or request? This session will focus on mitigating the potential risks this situation presents. You will learn about:
* identifying and managing of personal information databanks
* implementing corporate retention and disposition programs
* leveraging existing electronic information management tools.

Speaker(s):

Sandra Smith-Frampton, Corporate Privacy Officer, ATB Financial

Sandra Smith-Frampton is the Senior Risk Manager and Corporate PrivacyOfficer for ATB Financial. She and her team are responsible for sustained privacy compliance for the parent company, four subsidiaries and 4200+ employees. She has extensive privacy, information, and operational risk management experience that spans various industries including, oil and gas, municipal, education, communications and financial. Sandra participates on various advisory groups, has been an instructor for an accredited college, and a presenter for numerous local, national and international associations located across Canada and the United States.

She is a graduate of the University of Alberta's National Information, Access and Protection of Privacy (IAPP) program, a Certified Information Privacy Professional (CIPP/C), and a Certified Records Manager (CRM).

Sandra's presentations often display her zest for life, as well as her ardour for privacy.

3:45pm – 4:30pm

Building Consumer Trust

Speaker(s):
Wally Hill, CPO, Canadian Marketing Association
Hugh McCarrel, CPO, Holt Renfrew

How you handle your consumer's personal information is a critical element in building consumer trust. Holt Renfrew (Voted one of Canada's Top Privacy Policies in 2006)knows that in their business consumer trust is critical. This session will give you an inside look at how privacy impacts consumer trust and your reputation in the marketplace and how the way in which you handle your customer's personal information can be turned into a business advantage.

Speaker(s):

Wally Hill, CPO, Canadian Marketing Association

As V.P. Public Affairs and Communications, Wally has responsibility for the strategy and program development for CMA's activity in the public policy arena. His portfolio includes the Association's government relations, communications programs for members and the public, as well as the CMA's Ethics & Privacy and Postal Issues Committees, CMA's Special Interest Councils and related research activities. Wally's private sector background includes senior management positions with a major Canadian financial institution, as well as several years in the Communications and Government Relations consulting business. Prior to that, he worked as a senior advisor at a number of Federal Government Ministries, and he has served as Chief of Staff to the Minister of Industry, and the Government House Leader & Minister Responsible for Canada Post Corporation.

Hugh McCarrel, CPO, Holt Renfrew

Hugh McCarrel is the Vice President, Planning & Control, Corporate Secretary, and Chief Privacy Officer for Holt, Renfrew and Co., Limited. Hugh is a Chartered Accountant having articled with KPMG. He has worked in the retail industry with the HBC, Comark , and for the past fifteen years with Holt Renfrew, one of Canada's leading fashion retailers. Hugh took on the additional role of Corporate Secretary five years ago and as part of these duties, chaired the Privacy Committee at Holts. He was appointed the Chief Privacy Officer in December 2003. He is married to Joan and has two daughters. He is an avid curler, boater and enjoys reading, travel and golf.

4:30pm – 4:30pm

End of Day