Éloïse Gratton Ad. E.

Partner

Executive Summary

Eloïse is recognized internationally as a pioneer in the field of privacy. She offers strategic advice relating to best business practices relevant to the monetization of big data and the use of artificial intelligence, in addition to providing support in crisis management situations (e.g. security breaches, privacy commissioners’ investigations, class actions) both nationally and internationally. She also advises companies and their board of directors on the management of personal information and the protection of privacy, including:

  • compliance
  • risk management
  • ethics
  • data governance.

Éloïse’s publications are consulted in Canada and abroad, used in law courses and cited in academic journals as well as in landmark privacy decisions by the Supreme Court of Canada. She authored Internet and Wireless Privacy: A Legal Guide to Global Business Practices, one of the first technology and privacy book in Canada (CCH, 2003). Her recent works include Privacy in the Workplace, 4th edition (LexisNexis, 2017), Practical Guide to e-Commerce and Internet Law (LexisNexis 2015) and Understanding Personal Information: Managing Privacy Risks (LexisNexis, 2013). In addition to being a sought-after lecturer and speaker, she is a regular commentator on current issues that affect privacy in Canada and the United States (Wall Street Journal, Fast Company). She is recognized as a leading expert in her field by privacy commissioners as well as by the federal and provincial governments. She has testified before the House of Commons’ Standing Committee on Access to Information, Privacy and Ethics (ETHI) and Standing Committee on Industry, Science and Technology (INDU).

Within the firm, Éloïse is the National Co-Leader of the Privacy and Data Protection Group. She is nominated by her peers in the IT law and privacy category of Best Lawyers in Canada and recognized by Chambers as a leading lawyer (Band 1) in the area of ​​privacy and data protection year after year. She was recently honored by Canadian Lawyer magazine as a forward thinker in an article about the country’s 25 most influential lawyers, as well as selected as one of Canada’s Top 100 Most Influential Women by the Women's Executive Network (WXN) in the “CIBC Trailblazers & Trendsetters” category for 2018.

Representative Work

  • Advised a consumer credit company in the response to a global security breach, including providing assistance relating to privacy regulators’ investigation.
  • Conducted global compliance assessments and implementation programs for Fortune 300 clients in the technology, media, financial services.
  • Assisted a Fortune 300 in the management of a large security incident involving ransomware.
  • Developed a framework for SOQUIJ to manage privacy risks when developing new solutions and products relying on Artificial Intelligence (referenced in the recent 2018 Québec AI Committee report).
  • Conducted a comprehensive review of the client data privacy and security practices for one of Canada’s largest retailers.
  • Provided a legal opinion for a Fortune 300 financial institution business practice involving big data analytics and the development of consumer scores.
  • Led investigation of sophisticated cyberattack for a financial services company and its board of directors.
  • Defended a global technology company that specializes in Internet-related solutions relating to privacy class actions.
  • Assisted a large media company to comply with privacy law when deploying cutting-edge marketing strategies.

Publications & Presentations

Events

  • Speaker, "Renseignements personnels : Opportunités et risques," Le Cercle des Présidents du Québec (January 30, 2019)
  • Co-Speaker, "Cybersécurité et vie privée des employés: et si vos équipiers vous rendaient vulnérables?," Yvon Blais - Thomson Reuters, Montréal, November 2, 2018.
  • Co-Speaker, "Latest Developments in Canadian and International Privacy Law," 2018 CAN-TECH Law - 22nd Annual Conference, Montreal, Marriott Chateau Champlain, October 30, 2018.
  • Co-Speaker, "Canadian Update," CBA Access to Information and Privacy Law, Ottawa, October 19, 2018. Château Fairmont.
  • Co-Speaker, "Council for Chief Privacy Officers Panel Discussion," Conference Board of Canada, CPO Meeting, October 11, 2018.
  • Co-Speaker, "Les dix risques les plus importants en matière de protection de la vie privée," Congrès ACC Québec, September 12, 2018.
  • Co-Speaker, "Will the Right to be Forgotten Find Application in the Canadian Context?," IAPP Canada Privacy Symposium 2018, Toronto, May 25, 2018.
  • Keynote, "How will the GDPR impact Canada?," IAPP Canada Privacy Symposium 2018, Toronto, May 25, 2018.
  • Moderator, "The Next Generation of Privacy Professionals: Women Leading Privacy," IAPP Canada Privacy Symposium 2018, Toronto, May 24, 2018.
  • Co-Speaker, "Privacy and Cybersecurity Hot Business Risks," IAPP Canada Privacy Symposium 2018, Toronto, May 24, 2018.
  • Speaker, "Commercialisation des données + numérique," Le droit à l'épreuve du numérique, 4ième conférence CRDP / IRDA, Salon François Chevrette, Faculté de droit de l'Université de Montréal, May 7, 2018.
  • Speaker, "Nouveaux enjeux en protection de la vie privée: Mise à niveau 2018," Association des professionnels en accès à l'information et en protection de la vie privée, Les journées professionnelles en AIPVP, Québec (Université Laval), May 4, 2018.
  • Keynote interview, "An Interview with Isabelle Falque-Pierrotin," IAPP Global Privacy Summit 2018 (Washington), Washington, DC, March 27, 2018.
  • Co-Speaker, "Actions collectives en matière d’atteintes à la vie privée et bris de confidentialité," Colloque National sur l'Action Collective: Développements récents au Québec, au Canada et aux États-Unis (2018), Montréal, March 22, 2018.
  • Guest Lecturer , "When selling you stuff online clashes with your privacy rights," Cybersecurity and Privacy - LAWG 534 , McGill University, Faculty of Law, November 7, 2017.
  • Moderator, "Canadian Update," CBA Access to Information and Privacy Law Symposium , Ottawa, Ontario, October 27-28, 2017.
  • Co-Speaker, "Legal Control of Internet Content: Who Decides and What is the Impact?," 2017 IT.CAN, 21st Annual Conference, The St. Andrew’s Club and Conference Centre 150 King St. West, 16th Floor Toronto, ON, October 24, 2017.
  • Co-Speaker, "Learn from My Fail: Avoiding Privacy Program Snafus & Screw-Ups," Privacy. Security. Risk. 2017 (IAPP), San Diego, CA, October 17, 2017.
  • Speaker, "Handling Sensitive Data and Managing Privacy Issues," Responsible Openness: What You Need To Know To Get Started Today - RDA 10th Plenary Collocated Event, Centre Mont-Royal , September 18, 2017.
  • Speaker, "Complying with Canada’s Upcoming Breach Notification Requirements," Complying with Canada’s Upcoming Breach Notification Requirements, Webinar, August 29, 2017.
  • Co-Speaker, "Réagir efficacement lors d’une faille de cybersécurité," Conférence Barreau de Montréal — Montpetit-Recrutement | Ressources Humaines, Centre de conférences Le 1000, niveau mezzanine , May 24, 2017.
  • Moderator, "Women Leading Privacy: Career Diversity and Building A Pathway to Board Leadership," IAPP Canada Privacy Symposium 2017, May 18, 2017.
  • Co-Speaker, "Should the Right to be Forgotten Jump the Atlantic?," Should the Right to be Forgotten Jump the Atlantic?, IAPP Canada Privacy Symposium 2017, Toronto, May 17, 2017.
  • Speaker, "Innovations technologiques et " big data " : Extraire et utiliser des informations stratégiques à valeur ajoutée tout en gérant ses risques," Femmes Leaders, 7e édition, S'engager et s'élever pour performer avec agilité dans la turbulence, Événements Les Affaires, Montréal, May 16, 2017.
  • Moderator, "Global Regulatory Trends: Positioning Canada for Economic Prosperity," Canadian Privacy Summit 2017, BMO Financial Group Institute for Learning, Toronto, Tuesday May 2 - Wednesday May 3 2017 .
  • Co-Speaker, "Données massives et publicité ciblée : Comment utiliser les renseignements des clients en toute Legal.IT," Legal.IT 2017, March 23, 2017.
  • Speaker, "Cybersécurité : Ce que tout haut dirigeant doit savoir en matière de gouvernance et gestion de risques," Hop! Le Sommet du commerce de détail, March 22, 2017.
  • Appearance, "Appearance Before the Standing Committee on Access to Information, Privacy and Ethics to discuss PIPEDA," Standing Committee on Access to Information, Privacy and Ethics (ETHI) 42nd Parliament, 1st Session, Meeting No. 46, Room 420, Wellington Building, 197 Sparks Street, Ottawa, February 14, 2017.

Insights

  • Co-author, "Public Facebook Profiles Not Equivalent to Public Information under PIPEDA," Canadian Corporate Counsel, Vol, 27, No. 5 (June/July 2018).
  • Co-author, "ETHI Committee Prepares for GDPR Adequacy Assessment in New Report on PIPEDA," Canadian Privacy Law Review, Vol. 15 No 6 (May 2018).
  • Co-author, "OPC Report Asserts PIPEDA Protections are Similar to EU “Right to be Forgotten”," Canadian Privacy Law Review, Vol.15 no. 5, April 2018.
  • Co-author, "New Committee Report on CASL Highlights Need for Clarification and Education," Canadian Privacy Law Review, LexisNexis, Vol. 15, No. 4 (March 2018).
  • Co-author, "SCC Recognizes Expectation of Privacy in Text Message Conversations," Internet and E-commerce Law in Canada, LexisNexis, Vol. 18, No. 10 (February 2018)
  • Co-author, "SCC Recognizes Expectation of Privacy in Text Message Conversations," Canadian Privacy Law Review, LexisNexis, Vol. 15, No 3 (February 2018).
  • Co-author, "Google Inc c Equustek Solutions Inc: Les injonctions d’application mondiale visant le retrait de résultats de recherche : un nouveau remède d’exception en matière de propriété intellectuelle," Les Cahiers de la Propriété Intellectuelle, Vol. 30, No 1, janvier 2018. HTML
  • Co-author, "Uncertainty following two Canadian rulings on forum selection clauses," Leading Internet Case Law, Cecile Park Media, December 2017. PDF
  • Co-author, "Supreme Court of Canada Confirms in Douez v. Facebook That a Business Cannot Contract Out of Local Privacy Law," Canadian Privacy Law Review, (2017), 14 C.P.L.R. (September 2017).
  • Co-author, "Superior Court of Quebec Authorizes Privacy Class Action in Zuckerman v. Target Corporation," Canadian Privacy Law Review, 14 C.P.L.R. (May 2017).
  • Co-author, "Droit À L’Oubli: Canadian Perspective on the Global ‘Right to Be Forgotten’ Debate," Colorado Technology Law Journal, Vol 15, Issue 2 (2017).
  • Co-author, "Important Recommendations from the Québec Privacy Commissioner on the Protection of Personal Information," (2017), 14 C.P.L.R. (March 2017)
  • Co-author, "Using Social Insurance Numbers for Identification Purposes: Canadian Perspective on Legal and Privacy Risks, Trusts and Trustees," Oxford Journals, Oxford University Press, U.K., 2017.
  • Co-author, "CASL Enforcement Decision - Sending Messages Without Consent," (2017), 14 C.P.L.R. (January 2017).
  • Author, "Publicité ciblée et défis en matière de protection de renseignements personnels, Le consommateur numérique : une protection à la hauteur de la confiance?," Éditions Yvon Blais, automne 2016.
  • Author, "Privacy best practices for mHealth apps," Health Legal, U.K., Octobre 2016. PDF
  • Author, "Right to be forgotten v. the public interest," Lawyers Weekly, July 8, 2016
  • Author, "Special to the Financial Post, Forget about bringing the ‘right to be forgotten’ to Canada," Financial Post, May 9, 2016.
  • Author, "Canadian Supreme Court to rule in territoriality principle, Ramifications for extraterritorial applicability of privacy laws," Data Protection Law & Policy, Strategic Analysis by DataGuidance, March 2016, Volume 13, Issue 03.
  • Author, "Ontario Court Recognizes Existence of New "Revenge Porn" Privacy Tort," BLG Publication, January 28, 2016.
  • Author, "Five Common Mistakes Made in Drafting Website Privacy Policies, Internet and E-Commerce Law in Canada," LexisNexis, Volume 16, Number 4, August 2015.
  • Author, "Online Access to Court Decisions and Privacy Implications," Canadian Privacy Law Review, Volume 12, Number 8, LexisNexis, July 2015.
  • Author, "New Requirements Of The Digital Privacy Act (Bill S-4), Canadian Corporate Counsel," Canada Law Book (a division of Thomson Reuters Canada Ltd.), June 2015.
  • Author, "Canadian Legal Requirements for Online Behavioral Marketing," U.K., DataGuidance, June 2015.
  • Author, "Health-Tracking Bracelets and Privacy Issues," Canadian Privacy Law Review, Vo. 12, Number 4, LexisNexis, March 2015.

Media

Press

  • Samantha Beattie, "Canadians Want Power To Be ‘Forgotten’ On Search Engines Like Google: Poll. Huffington Post," January 11, 2019. huffingtonpost.ca
  • Kyle Duggan, "Lawyers warn of ‘notice fatigue’ from OPC breach guidelines," The Wire Report, October 10, 2018.
  • Tim Sandle, "Q&A: Time to reform Canada’s data privacy laws?," Digital Journal, Internet, October 9, 2018. digitaljournal.com
  • Éric Martel, "Comprendre les enjeux juridiques du respect de la vie privée. Droit Inc. ," September 24, 2018. droit-inc.com
  • Tom Webb, "Lacking bite. Global Data Review," September 6, 2018. globaldatareview.com
  • Julius Melnitzer, "GDPR Impact: EU’s privacy rules have broad reach, even for Canadian companies with no European business," LEXPERT, August 8, 2018. lexpert.ca
  • Robert Post, "Data Privacy and Dignitary Privacy: Google Spain, the Right to Be Forgotten, and the Construction of the Public Sphere," Duke Law Journal, 2018, July 10, 2018 ((Yale Law School, Public Law Research Paper No. 598)). ssrn.com
  • Julius Melnitzer, "Chatbot aids firms’ privacy compliance by finding client exposures within data breach laws," Financial Post, July 4, 2018. business.financialpost.com
  • Howard Solomon, "GDPR violation lawsuit filed, watch out for EU country-specific tweaks," IT World Canada, May 28, 2018. itworldcanada.com
  • Marc Cassivi, "Le monde d’Orwell. La Presse, Chronique," May 13, 2018. plus.lapresse.ca
  • Karim Benessaieh, "Remous autour de la vie privée. La Presse+, Technologie," April 25, 2018. mi.lapresse.ca
  • Nora Young, "Facial recognition technology is tracking billions in China. Could it happen here?," CBC, Spark, April 15, 2018. cbc.ca
  • Sam Pfeifle, "Falque-Pierrotin: We understand GDPR is a learning curve," IAPP, The Privacy Advisor, March 28, 2018. iapp.org
  • Delphine Jung, "Données personnelles utilisées : qu’en disent les avocats ?," Droit Inc., March 21, 2018 (L’affaire Cambridge Analytica pose plusieurs questions légales sur la collecte des données personnelles). droit-inc.com
  • Report of the Standing Committee on Access to Information, Privacy and Ethics. Towards Privacy by Design: Review of the Personal Information Protection and Electronic Documents Act. House of Commons Canada, 42nd PARLIAMENT, FIRST SESSION, February 28, 2018. ourcommons.ca
  • Alizée Calza, "Cybersécurité et protection des données : que faire pour éviter les bris ?," Finance et Investissement, February 15, 2018. finance-investissement.com
  • Office of the Privacy Commissioner of Canada, "Draft OPC Position on Online Reputation," January 26, 2018. priv.gc.ca
  • Simon Lord, "La réputation des avocats s’améliore… peut-être," Les Affaires, January 13, 2018. lesaffaires.com
  • Dominique Tardif, "L’avocate de la vie privée. Droit Inc.," Faisons parler les leaders, December 6, 2017. droit-inc.com
  • Defamation Law in the Internet Age, Law Commission of Ontario, Consultation Paper, November 2017. lco-cdo.org
  • Kaveh Lahooti, "Canada: OPC guidance proposes “more nuanced approach” to gaining online consent," DataGuidance, Privacy This Week, October 5, 2017. dataguidance.com
  • Office of the Privacy Commissioner of Canada, "2016-17 Annual Report to Parliament on the Personal Information Protection and Electronic Documents Act and the Privacy Act," Report on Consent, September 2017. priv.gc.ca
  • Luis Millan, "Ottawa releases proposed regulations on data breach notifications," Lawyers Daily, September 14, 2017. thelawyersdaily.ca
  • Howard Solomon, "Proposed federal data breach reporting regs good for business: Lawyer,"  IT World Canada, September 13, 2017. itworldcanada.com
  • Desbiens et Secrétariat du Conseil du Trésor. 2017 QCCFP 34 (CanLII), August 22, 2017. canlii.org
  • Delphine Jung, "Des avocats qui ont du mérite!," Droit Inc. , August 7, 2017. droit-inc.com
  • Mallory Hendry, "Last minute reprieve as feds suspend controversial private right of action provision in CASL," Canadian Lawyer, June 7, 2017. canadianlawyermag.com
  • Peter Menyasz, "Canadian Genetic Testing Law to Face Constitutional Review," Bloomberg BNA, Bloomberg Law: Privacy & Data Security, May 9, 2017. bna.com
  • Karl Rettino-Parazelli, "Données personnelles – Les entreprises mises sous pression par leurs clients," Le Devoir, 25 avril 2017. ledevoir.com
  • Delphine Jung, "Données personnelles et pub : les avocats appelés en renfort. Droit Inc.," April 10, 2017. droit-inc.com

Radio

  • Nora Young, "The surveillance potential of facial recognition," CBC Radio Podcats, Spark, April 15, 2018. podcast-a.akamaihd.net

TV

  • Frédéric Arnould, "Vos données scrutées à la loupe (Cambridge Analytica)," Radio-Canada, Téléjournal 22h, March 20, 2018. ici.radio-canada.ca

Rankings & Recognitions

  • Selected as one of Canada’s Top 100 Most Influential Women in Canada by the Women's Executive Network (WXN) in the “CIBC Trailblazers & Trendsetters” category for 2018.
  • Recognized in the 2019 and previous editions of Chambers Canada  Canada's Leading Lawyers for Business (Privacy & Data Protection)
  • Recognized in the 2018 and previous editions of The Canadian Legal Lexpert® Directory (Computer and IT Law)
  • Recognized by Lexpert® with a 2017 Zenith Award  Celebrating Women in Law
  • Recognized as "Information Technology and Privacy and Data Security Lawyer of the Year — Montréal" in the 2019 edition of The Best Lawyers in Canada®
  • Recognized in the 2016-2019 editions The Best Lawyers in Canada® for information technology law and the 2018-2019 editions for privacy and data security law
  • Honored by Canadian Lawyer magazine as a one of the 25 most influential lawyers in 2016
  • Awarded a Clawbies Canadian Legal Blog Award in 2014 for the best new legal blog for her blog on privacy and IT law