Éloïse Gratton Ad. E.

Éloïse Gratton

Ad. E.

Partner and National Leader, Privacy and Data Protection

Toronto
Montréal
[email protected]
416.367.6225  514.954.3106

Éloïse is recognized internationally as a pioneer in the field of privacy. She leads the firm's national Privacy and Data Protection practice and is a member of the Partnership Board. She offers strategic advice relating to best business practices relevant to the monetization of big data and the use of artificial intelligence, in addition to providing support in crisis management situations (e.g. security breaches, privacy commissioners’ investigations, class actions) both nationally and internationally. She also advises companies and their board of directors on the management of personal information and the protection of privacy, including on issues relating to compliance, risk management, ethics and data governance.

Éloïse’s publications are consulted in Canada and abroad, used in law courses and cited in academic journals as well as in landmark privacy decisions by the Supreme Court of Canada. She authored Internet and Wireless Privacy: A Legal Guide to Global Business Practices, one of the first technology and privacy book in Canada (CCH, 2003). Her recent works include Managing Privacy in a Connected World (LexisNexis 2020), Privacy in the Workplace, 4th edition (LexisNexis, 2017), Practical Guide to e-Commerce and Internet Law (LexisNexis 2015) and Understanding Personal Information: Managing Privacy Risks (LexisNexis, 2013). In addition to being a sought-after lecturer and speaker, she is a regular commentator on current issues that affect privacy in Canada and the United States (Wall Street Journal, Fast Company). She is recognized as a leading expert in her field by privacy commissioners as well as by the federal and provincial governments. She has testified before the House of Commons’ Standing Committee on Access to Information, Privacy and Ethics (ETHI) and Standing Committee on Industry, Science and Technology (INDU).

She is nominated by her peers in the IT law and privacy category of Best Lawyers in Canada and recognized by Chambers as a leading lawyer (Band 1) in the area of privacy and data protection year after year. She was recently honored by Canadian Lawyer magazine as a forward thinker and selected twice as one of the country’s 25 most influential lawyers, as well as selected as one of Canada’s Top 100 Most Influential Women by the Women's Executive Network (WXN) in the “CIBC Trailblazers & Trendsetters” category.

Testimonials

Experience

  • Advised multinational technology companies, Canadian Big Five banks and global pharmaceuticals on compliance issues arising from Canadian privacy law reforms, including Québec's Bill 64/Law 25 and the federal government's proposed privacy reform bill, Bill C-27 and its impact on certain technological products including guidance on how to comply with new privacy by default and by design requirements.
  • Advised an American multinational technology company focusing on e-commerce, cloud computing, online advertising, digital streaming, and artificial intelligence in the conduct and drafting of privacy impact assessments and privacy policies and procedures for projects involving AI-enabled surveillance devices and biometric systems.
  • Retained by a multinational pharmaceutical company to provide advice and assistance on a variety of privacy matters, including: updating global, internal privacy policies and procedures to comply with Canadian privacy law reforms, including Québec's Bill 64/Law 25; advising on compliance issues arising from the collection and processing of personal information in connection with the client's various business activities, such as patient support programs and digital marketing initiatives; and facilitating cross-border data transfers between Canada, the United States and the European Union in compliance with Canadian and foreign privacy laws.
  • Assisted an American multinational technology company to support its launch of new product features or services, such as enhanced search capabilities on its e-commerce website, real-time package delivery tracking, and personalized features on its digital streaming service.
  • Assisted a Canadian chain home improvement retailer in relation to an investigation from the Office of the Privacy Commission of Canada pertaining to its use of offline conversion tools.
  • Retained by multinational technology company and Canadian Big Five banks to advise on the collection and use of employee et client personal information through novel technologies for internal investigative purposes.
  • Retained by a Crown corporation and a Confederation of National Trade Union's development fund for cooperation and employment to provide training on privacy and cyber risks to the corporate board members.
  • Retained by a Canadian Big Five bank to conduct a comprehensive review of its privacy and data protection compliance strategy in response to recent privacy law reforms in Canada, including providing guidance on various privacy-related issues such as biometrics and regulatory reporting, consent management, breach reporting and record-keeping, and outsourcing and cross-border transfers to improve compliance with federal and provincial privacy laws.
  • Advised an American multinational technology company with regards to an investigation by the Québec privacy regulator to determine whether there is a right to be forgotten in Québec.
  • Provided privacy training to Canadian Big Five bank legal and privacy department employees on conducting privacy impact assessments and navigating Québec's privacy reforms to enable employees to effectively identify and mitigate privacy risks arising from the bank's data processing activities and to familiarize them with new legal and regulatory developments.
  • Drafted a privacy impact assessment for a multinational technology and e-commerce company pertaining to an illicit motion monitoring program involving the use of novel technologies designed to enhance the security of safety-critical areas within its data centres.
  • Assisted a large Canadian digital retailer with the conduct of a privacy risk assessment for innovative study that sought to collect employee personal information to better understand and predict burnout and fatigue in the workplace.
  • Advised an American multinational technology company focusing on online advertising, search engine technology, cloud computing, computer software, quantum computing, e-commerce, artificial intelligence, and consumer electronics with regards to a privacy class action in Québec alleging mishandling of user data and breach of user privacy in connection with various products and services, such as online browsers, analytics and digital ads, included providing strategic legal advice, defending the company's position in court, and advocating for its interests.
  • Retained by a business association representing over 60 domestic and international banks operating in Canada to advise its members on the recent reforms to Québec's privacy laws, with a particular focus on notice and consent requirements and their impact on various banking channels, including digital, in-person and telephone services.
  • Assisted an American multinational company serving the combined industries of health information technology and clinical research, including assisting the business with the implementation of innovative data processing initiatives involving predictive data analytics in the health care and pharmaceutical care sectors, negotiating an authorization to receive health data for research purposes with Québec's privacy regulator and preparing a submission to the Québec government regarding a bill to enact a new health privacy law in the province (Bill 3).
  • Retained by a multinational pharmaceutical company to conduct virtual and in-person training sessions for the client's legal and marketing teams on Canadian privacy law reforms and their impact on the client's business activities.
  • Assisted Canada's largest railway operator and one of the largest in North America, to manage two large-scale access to personal information requests which required an e-discovery process, providing its response to critical security incidents and data breaches, reviewing its privacy policies and procedures for compliance with the new GDPR-inspired requirements introduced by Bill 64 in Québec (e.g. privacy impact assessments, Privacy by Design and by Default, tracking and profiling technologies, automated decision-making, cross-border transfers, etc.) and advising on the responsible use of biometric technologies in its terminals and workplaces.
  • Retained by Canadian entertainment centre chain to provide breach response advice, where a breach in its service provider security led to the compromise of clients' data and loyalty rewards.
  • Advised a consumer credit company in the response to a global security breach, including providing assistance relating to privacy regulators’ investigation.
  • Conducted global compliance assessments and implementation programs for Fortune 300 clients in the technology, media, financial services.
  • Assisted a Fortune 300 in the management of a large security incident involving ransomware.
  • Developed a framework for SOQUIJ to manage privacy risks when developing new solutions and products relying on Artificial Intelligence (referenced in the recent 2018 Québec AI Committee report).
  • Conducted a comprehensive review of the client data privacy and security practices for one of Canada’s largest retailers.
  • Provided a legal opinion for a Fortune 300 financial institution business practice involving big data analytics and the development of consumer scores.
  • Led investigation of sophisticated cyberattack for a financial services company and its board of directors.
  • Defended a global technology company that specializes in Internet-related solutions relating to privacy class actions.
  • Assisted a large media company to comply with privacy law when deploying cutting-edge marketing strategies.

Beyond Our Walls

Professional Involvement

  • Board Member, Fédération de natation du Québec (FNQ)
  • Member, Canadian Chamber of Commerce, Digital Economy Committee
  • Member, International Association of Privacy Professionals

Awards & Recognitions

  • Recognized in the 2024 editions (and since 2016) of The Best Lawyers in Canada®- (Privacy and Data Security Law) and as "Information Technology and Privacy and Data Security Lawyer of the Year — Montréal" in the 2019, 2021 and in the 2023 editions and recognized in 2023 as 'Lawyer of the Year'.
  • Recognized in the 2024 and previous editions of Chambers Canada — Canada's Leading Lawyers for Business (Band 1 - Privacy & Data Protection (Nationwide - Canada))
    • Privacy & Data Protection:
      • Éloïse Gratton is a highly acclaimed privacy expert with experience providing advice to some of Canada's leading financial institutions, as well as multinational technology companies. She splits her time between Toronto and Montréal.
      • "Eloise is an exceptional lawyer and privacy specialist. She is able to understand complex technologies and business objectives, and provide practical legal guidance."
      • "She is pragmatic, has business judgement, and is knowledgeable and available."
  • Recognized in the 2024 edition of Lexpert/American Lawyer Guide to the Leading 500 Lawyers in Canada (Data & Privacy Protection).
  • Recognized in the 2023 Women in Law Leadership Stronger Together Award
  • Recognized as a 2023 Thomson Reuters Stand-out Lawyer
  • Honored by Canadian Lawyer magazine as a one of the 25 most influential lawyers (in 2016 and in 2021).
  • Recognized in the 2023 edition (and since 2020) of Lexpert Special Edition: Technology and Health Sciences
  • Recognized in the 2024 edition (and since 2023) of The Canadian Legal Lexpert® Directory (Advertising & Marketing Law; Computer & IT Law; Data Protection & Privacy), 2024 and 2022 editions (Technology Transactions), 2021 edition (Advertising & Marketing Law), and in 2021 and previous editions (Computer and IT Law).
  • Recognized in the 2023, 2022 and 2020 edition of Who's Who Legal (Data & Privacy Protection).
  • 2019 Québec Businesswoman Award (Prix Femmes d’affaires du Québec) in the Executive, Manager or Professional, Private Company category
  • Recognized in Acritas Stars 2019: Independently Rated Lawyer (Nominated as a stand-out lawyer by senior in-house counsel)
  • Selected as one of Canada’s Top 100 Most Influential Women in Canada by the Women's Executive Network (WXN) in the “CIBC Trailblazers & Trendsetters” category for 2018
  • Recognized by Lexpert® with a 2017 Zenith Award — Celebrating Women in Law

Bar Admission & Education

  • Québec, 1998
  • Ontario, 2022
  • LLD (Hons.), Université Paris 2 Panthéon-Assas and Université de Montréal, 2012
  • LLM, Université de Montréal (IT law), 2002
  • LLB, Université de Montréal, 1997
  • ICD.D., Corporate Governance, Institute of Corporate Directors, 2022