The Merger Without a Privacy Officer
In 2025, Briarwood Outdoor (BC-based, 210 employees, 300,000 customers, subject to BC PIPA) acquired Kiln Software (Ontario-based, 60 employees, 8,000 business customers, PIPEDA). The combined company now has 15,000 Quebec customers, 90 third-party vendors (12 critical), a 90-day backlog of 40 access requests, and no designated privacy officer. Privacy training is an annual slide deck; completion is 42%. Kiln's incident response plan has never been tested. The board wants a 12-month plan, a budget, and a single set of metrics. The CEO says 'we're mostly BC and Ontario, so Quebec is just a small piece.' The general counsel wants to know what to do first and how to report progress.
1. Prioritize the first 90 days of the privacy program. Justify each action by legal risk and operational impact.
Read the worked answer
The first action is to designate a privacy officer with a written mandate and direct access to the board or a board committee. PIPEDA accountability and Quebec's Law 25 both require designated responsibility, and without it the other work has no owner. The second is to create a data and vendor inventory focused on the 12 critical vendors and Quebec customer data, because the company cannot assess risk or draft contracts without knowing where personal information sits.
The third is to triage the 40 access requests. Both PIPEDA and BC PIPA set a 30-day response period, with limited extensions, so a 90-day backlog is a live compliance problem. The privacy officer should assign an owner, create a tracker, and clear the oldest and most complex requests first. The fourth is to adopt a tested incident-response plan, because a breach during the 90 days would expose the absence of a plan. The fifth is to fix the highest-risk consent and notice gaps, especially for Quebec customers, and to begin vendor contract remediation for critical vendors.
Training and policy work should start but not lead. The sequencing reflects legal deadlines and harm: access requests and incident readiness are immediate, while a full policy suite can follow. The board should see a 90-day scorecard, not a promise of a future framework.
2. Design a governance and reporting model for a company operating under PIPEDA, BC PIPA and Quebec Law 25. What metrics should the board see?
Read the worked answer
Governance should be centralized but not uniform. A privacy office led by the privacy officer should own the program, with regional counsel or designated contacts for BC, Ontario and Quebec. A privacy steering committee with legal, security, HR, marketing and product should meet monthly and escalate risk to the board quarterly. Business units should own their data and vendor risks under a RACI model, while the privacy office sets standards, reviews high-risk initiatives and investigates incidents.
Board metrics should be few and decision-useful. Access requests: number received, percentage closed within 30 days, extensions used and backlog age. Incidents: number, reportable versus non-reportable, time to detect, time to notify, and open remediation. Vendors: percentage of critical vendors with current assessments and privacy terms. Training: completion by role, not just overall. Assessments: PIAs completed before launch and percentage of Quebec transfers assessed. Consent: complaints and opt-out rates. Breach records: completeness and retention.
The metrics should be tied to legal obligations and trends, not vanity. For example, a rising access backlog predicts regulatory complaints; a falling critical-vendor assessment rate predicts breach exposure. Quebec should be reported separately because its consent and transfer rules are stricter, not dismissed as a small segment.
3. How should the company harmonize consent and vendor management across the three regimes without overcomplicating operations?
Read the worked answer
The practical approach is to build to the highest common standard and use provincial overlays where the law requires. For consent, start with a single inventory of purposes and data flows, then draft plain-language notice that satisfies Quebec's clear, free, informed, specific and separate consent rules. PIPEDA and BC PIPA can generally operate within that stricter model, but the company should check where BC or federal law permits implied consent or has different employee-data rules. Marketing consents should be unbundled from service terms, and Quebec customers should see the transfer and foreign-access information.
For vendors, use a tiered program. All vendors get a baseline questionnaire and contract terms. Critical vendors, and any vendor receiving Quebec data or transferring it outside Quebec, get enhanced due diligence, a PIA where required, audit or certification evidence, subprocessor approval, breach notification, and deletion obligations. The same contract template can be used with a Quebec schedule and a BC schedule rather than three separate programs.
This avoids a fragmented set of regional policies while respecting the stricter Quebec requirements. The privacy office should own the template and the triggers, and business units should own execution. Training should explain the overlays so product teams do not treat every Quebec rule as optional.