Use of cookies by
Norton Rose Fulbright
We use cookies to deliver our online services. Details and instructions on how to disable those cookies are set out at By continuing to use this website you agree to our use of our cookies unless you have disabled them.

Privacy and access to information


Meet the team

Companies in the public and private sectors recognize that privacy and access to information issues touch on almost every area of their business. Increasingly, multi-jurisdictional corporations need to manage their business on a global basis that includes sharing of data across members of the same corporate group located in different countries. 

We are able to advise on privacy matters in all of the countries where our practice is present and our team includes members from our business, employment and labour, litigation and intellectual property practices. Our cross-functionality enables us to give focused advice to specific business units while keeping management apprised of the big picture on emerging privacy trends and global standards. We offer practical solutions to privacy issues that arise in marketing, client development, human resources and customer credit initiatives. We regularly assist clients with representations to the Information Commissioner and the Privacy Commissioner of Canada and their provincial equivalents, as well as before the Federal Court and Superior Courts.

Our multi-disciplinary expertise allows us to provide solutions to privacy issues arising around:

  • information technologies including Internet privacy compliance, and system design and security with respect to use and transfer of personal information;
  • marketing and advertising initiatives;
  • transfer of personal information to subsidiaries, joint ventures and strategic alliances;
  • international issues, including compliance with U.S. “safe harbor” requirements and information transfer agreements under the European Union Data Directive;
  • data and security breaches;
  • outsourcing of storage, data processing and other personal information functions;
  • the sale and financing of public or private companies;
  • mergers, acquisitions and financings;
  • hiring, including the design of web hiring sites, evaluation practices and employee requests for access to their personnel files;
  • product design and development to ensure privacy legislation compliance;
  • privacy obligations and warranties related to customers, suppliers and business partners; and
  • banking and financial products.

We offer you:

  • development of multi-jurisdictional privacy policies for Canadian and multinational business;
  • drafting and implementing contracts and framework agreements governing the transfer or sharing of personal information across jurisdictions and, where necessary, obtaining the approval of Data Protection Authorities in other countries;
  • assistance responding to data breach and loss of personal information events, including the management of legal obligations, risk of identity theft and management of reputational risk;
  • advice on implementation of cloud solutions;
  • regulatory, contractual and technical advice necessary for the collection and use of personal health information;
  • coordination and execution of privacy audits;
  • responses to requests for access to information in both the private and public sector and drafting third party responses to public sector access requests;
  • development of document retention and destruction policies;
  • assistance providing information required by government regulators in a way that ensures confidentiality;
  • litigation before administrative tribunals and provincial and federal courts; and
  • representation on complaints lodged with provincial/federal privacy and information commissioners.

Select client work

  • Advising industry leader on privacy issues respecting de-identification and possible re-identification of personal information, including health information.
  • Advised World Anti-Doping Agency on privacy issues surrounding Olympic athletes.
  • Advising corporations in all major industries on privacy policy issues, such as drug and alcohol testing, monitoring of employee use of both personal and work technological devices and networks and social network sites, as well as implementation of these policies so as to enable proof of the dissemination when and if the need arises.
  • Advising sports leagues on the privacy issues surrounding the promotion of products and services through their websites.
  • Advised multi-national corporation on collection of personal information of Canadian subsidiary for purposes of ediscovery in litigation in the United States.
  • Drafted submissions to federal institutions in response to third-party information requests. Successfully opposed disclosure or obtained severance of confidential financial and commercial information on the basis of mandatory and discretionary provisions of the federal Access to Information Act.
  • Responded to a personal information data loss issue for an international energy company, including disclosures to applicable Privacy Commissioners’ offices pursuant to legislation, and the management of notification to affected individuals and corporate reputational risks.