On September 5, 2012, the Information and Privacy Commissioner of Ontario (“IPC”) released a new guidance paper, entitled “A Policy is Not Enough: It Must be Reflected in Concrete Practices”. This guidance paper will be particularly useful for organizations seeking preliminary guidance on implementing the “privacy by design” principles developed by Commissioner Cavoukian.

The IPC outlines 7 steps for implementing privacy policies. Sensibly, the Commissioner acknowledges that there are no “one-size-fits-all” approaches for embedding privacy-by-design practices. Nevertheless, Commissioner Cavoukian notes that there are common steps to implementing a course of action. These steps are applicable to organizations of all sizes and complexity.

The following is a brief run-down on the steps and a few comments from my experience...

Please see full article below for more information.