Corporate and Business Integrity

On May 11, 2023, the Fighting Against Forced Labour and Child Labour in Supply Chains Act, S.C. 2023, c. 9 (the “Act”) was passed. The purpose of this Act is to implement Canada’s international commitment to contribute to the fight against forced labour and child labour, and to require certain entities to report on the measures they have taken to reduce the use of forced labour and child labour. The Act came into force on January 1, 2024, and reporting entities and federal institutions were required to submit their first report under the Act by May 31, 2024. In addition, Public Safety Canada (the “Government”) released the Guidance for reporting entities.  Scope of the Act The Act applies to government institutions and to any corporation, partnership, trust or other unincorporated organization that (i) is listed on a stock exchange in Canada or (ii) has a place of business in Canada, does business in Canada or has assets in Canada and that, based on its consolidated financial statements, meets at least two of the following conditions for at least one of its two most recent financial years: (a) it has at least $20 million in assets (b) it has generated at least $40 million in revenue (c) it employs an average of at least 250 employees (collectively, the “entities”) Or (iii) is prescribed by regulations. The obligation to report applies to any entity (a) producing, selling or distributing goods in Canada or elsewhere; (b) importing into Canada goods produced outside Canada; or (c) controlling an entity engaged in any of these activities. Entities are considered to be operating in Canada if they produce, sell or distribute goods in Canada. They may also be considered to be operating in Canada if they have employees, if they make deliveries, purchases or payments in Canada, or if they have bank accounts in Canada. It is important to note that doing business in Canada does not require having a place of business in Canada. Forced Labour vs. Child Labour For the purposes of this Act, child labour is defined as labour provided by minors that (i) is provided or offered to be provided in Canada under circumstances that are contrary to the laws applicable in Canada; (ii) is provided or offered to be provided under circumstances that are physically, socially or morally dangerous to them; (iii) interferes with their schooling; or (iv) constitutes the worst forms of child labour, as defined in article 3 of the Worst Forms of Child Labour Convention.1 Forced labour is labour provided by a person (i) in circumstances in which it would be reasonable to believe that their safety or that of a person known to them would be threatened if they failed to provide such labour; or (ii) in circumstances which constitute forced or compulsory labour, as defined in article 2 of the Forced Labour Convention.2 Entities With Reporting Obligations Any entity required to report annually to the Government under the Act must include in its report the steps taken during its previous financial year to prevent and reduce the risk of forced labour and child labour. In order to comply with the obligations imposed by the Act, the entity must also include in its report information on its structure, its activities relating to the production, sale, distribution or importation of goods, as well as the type of goods and place of operation, and the countries or regions involved in its supply chains. Lastly, the report must include a brief explanation of the entity’s due diligence policies and processes regarding forced labour and child labour, information on the training provided to employees, and the parts of its business that carry a risk of forced labour or child labour. Given that the steps taken to prevent and reduce forced labour and child labour can result in a loss of income for vulnerable families, the Act requires entities to identify the measures taken to mitigate such impact on these families. Publication of Reports Entities must not only comply with the format, approval and attestation requirements for their report before submitting it to the Government but also make it available to the public by publishing it on a prominent place on their website. They can submit their report in one of the two official languages, although the Government recommends that reports be published in both English and French. In addition, the Act requires entities incorporated under the Canada Business Corporations Act or any other federal law to provide a copy of the report to each shareholder at the same time as their annual financial statements. Offences and Fines Reporting entities that fail to submit their report or make it available to the public are liable to a fine of not more than $250,000 per offence.3 The senior executives, directors and employees of an entity are also liable to fines and criminal prosecution should the entity contravene the Act.4 Any offence committed by an entity may also entail reputational risk. Our Advice Introducing policies, procedures, audit tools and other rules—or improving existing ones—to prevent and reduce modern slavery is essential. Such policies and rules may include procedures for reporting and an investigation process to address concerns, as well as a whistleblower protection system (whistleblower policy or similar measures). Businesses should think about how they select suppliers and whether they should adopt rules for monitoring the activities of their suppliers and partners. They should also consider updating their agreements with existing suppliers or partners to ensure compliance with the requirements of the Act, in particular by including provisions prohibiting the use of forced labour or child labour in suppliers’ business activities. Other measures may include raising awareness and training staff, directors and officers on how to implement company policies and procedures aimed at identifying and preventing forced labour and child labour. Our team has developed tools to help reporting entities identify the parts of their business that carry a risk of forced labour or child labour. We will be monitoring upcoming government publications in response to the first reports that reporting entities submit and, if need be, we will release another article to clarify reporting obligations. For any questions or advice relating to your obligations under the Act, do not hesitate to contact our team. Section 1 of the Act; see also the Worst Forms of Child Labour Convention, adopted in Geneva on June 17, 1999, article 3: Link Section 1 of the Act; see also the Forced Labour Convention, adopted in Geneva on June 28, 1930, article 2: Link Section 19 of the Act. Section 20 of the Act.

While the Canadian government has said it intends to pass legislation dealing with cybersecurity (see Bill C-26 to enact the Critical Cyber Systems Protection Act), many companies have already taken significant steps to protect their IT infrastructure. However, the Internet of Things is too often overlooked in this process. This is in spite of the fact that many devices are directly connected to the most important IT infrastructure for businesses. Industrial robots, devices that control production equipment in factories, and devices that help drivers make deliveries are just a few examples of vulnerable equipment. Operating systems and a range of applications are installed on these devices, and the basic operations of many businesses and the security of personal information depend on the security of the devices and their software. For example: An attack could target the manufacturing equipment control systems on the factory floor and result in an interruption of the company’s production and significant recovery costs and production delays. By targeting production equipment and industrial robots, an attacker could steal the blueprints and manufacturing parameters for various processes, which could jeopardize a company’s trade secrets. Barcode scanners used for package delivery could be infected and transmit information to hackers, including personal information. The non-profit Open Web Application Security Project (OWASP) has released a list of the top ten security risks for the Internet of Things.1 Leaders of companies that use this kind of equipment must be aware of these issues and take measures to manage these risks. We would like to comment on some of the risks which require appropriate policies and good company governance to mitigate them. Weak or unchangeable passwords: Some devices are sold with common or weak initial passwords. It is important to ensure that passwords are changed as soon as devices are set up and to keep tight control over them. Only designated IT personnel should know the passwords for configuring these devices. You should also avoid acquiring equipment that does not allow for password management (for example, a device with an unchangeable password). Lack of updates: The Internet of Things often relies on computers with operating systems that are not updated during their lifetime. As a result, some devices are vulnerable because they use operating systems and software with known vulnerabilities. Good governance includes ensuring that such devices are updated and acquiring only devices that make it easy to perform regular updates. Poor management of the fleet of connected devices: Some companies do not have a clear picture of the Internet of Things deployed in their company. It is crucial to have an inventory of these devices with their role in the company, the type of information they contain and the parameters that are essential to their security. Lack of physical security: Wherever possible, access to these devices should be protected. Too often, devices are left unattended in places where they are accessible to the public. Clear guidelines should be provided to employees to ensure safe practices, especially for equipment that is used on the road. A company’s board of directors plays a key role in cybersecurity. In fact, the failure of directors to monitor risks and to ensure that an adequate system of controls is in place can expose them to liability. Here are some elements of good governance that companies should consider practising: Review the composition of the board of directors and the skills matrix to ensure that the team has the required skills. Provide training to all board members to develop their cyber vigilance and equip them to fulfill their duties as directors. Assess cybersecurity risks, including those associated with connected devices, and establish ways to mitigate those risks. The Act to modernize legislative provisions respecting the protection of personal information sets out a number of obligations for the board of directors, including appointing a person in charge of the protection of personal information, having a management plan and maintaining a register of confidentiality incidents. For more information, you can read the following bulletin: Amendments to Privacy Laws: What Businesses Need to Know (lavery.ca) Lastly, a company must at all times ensure that the supplier credentials, passwords and authorizations that make it possible for IT staff to respond are not in the hands of a single person or supplier. This would put the company in a vulnerable position if the relationship with that person or supplier were to deteriorate. See OWASP top 10

Quebec recently enacted Bill 96, entitled An Act respecting French, the official and common language of Québec, which aims to overhaul the Charter of the French language. Here are 10 key changes in this law that will impose significant obligations on businesses: As of June 1, 2025, businesses employing more than 25 people (currently the threshold is 50 people) for at least six months will be required to comply with various “francization”1 obligations. Businesses with between 25 and 99 employees may also be ordered by the Office québécois de la langue française (the OQLF)2 to form a francization committee. In addition, at the request of the OQLF, businesses may have to provide a francization program for review within three months. As of June 1, 2025, only trademarks registered in a language other than French (and for which no French version has been filed or registered) will be accepted as an exception to the general principle that trademarks must be translated into French. Unregistered trademarks that are not in French must be accompanied by their French equivalent. The rule is the same for products as well as their labelling and packaging; any writing must be in French. The French text may be accompanied by a translation or translations, but no text in another language may be given greater prominence than the text in French or be made available on more favourable terms. However, as of June 1, 2025, generic or descriptive terms included in a trademark registered in a language other than French (for which no French version has been registered) must be translated into French. In addition, as of June 1, 2025, on public signs and posters visible from outside the premises, (i) French must be markedly predominant (rather than being sufficiently present) and (ii) the display of trademarks that are not in French (for which no French version has been registered) will be limited to registered trademarks. As of June 1, 2022, businesses that offer goods or services to consumers must respect their right to be informed and served in French. In the event of breaches of this obligation, consumers have the right to file a complaint with the OQLF or to request an injunction unless the business has fewer than five employees. In addition, any legal person or company that provides services to the civil administration3 will be required to provide these services in French, including when the services are intended for the public. As of June 1, 2022, subject to certain criteria provided for in the bill, employers are required to draw up the following written documents in French: individual employment contracts4 and communications addressed to a worker or to an association of workers, including communications following the end of the employment relationship with an employee. In addition, other documents such as job application forms, documents relating to working conditions and training documents must be made available in French.5 As of June 1, 2022, employers who wish to require employees to have a certain level of proficiency in a language other than French in order to obtain a position must demonstrate that this requirement is necessary for the performance of the duties related to the position, that it is impossible to proceed using internal resources and that they have made efforts to limit the number of positions in their company requiring knowledge of a language other than French as much as possible. As of June 1, 2023, parties wishing to enter into a consumer contract in a language other than French, or, subject to various exceptions,6 a contract of adhesion that is not a consumer contract, must have received a French version of the contract before agreeing to it. Otherwise, a party can demand that the contract be cancelled without it being necessary to prove harm. As of June 1, 2023, the civil administration will be prohibited from entering into a contract with or granting a subsidy to a business that employs 25 or more people and that does not comply with the following obligations on the use of the French language: obtaining a certificate of registration, sending the OQLF an analysis of the language situation in the business within the time prescribed, or obtaining an attestation of implementation of a francization program or a francization certificate, depending on the case. As of June 1, 2023, all contracts and agreements entered into by the civil administration, as well as all written documents sent to an agency of the civil administration by a legal person or by a business to obtain a permit, an authorization or a subsidy or other form of financial assistance must be drawn up exclusively in French. As of September 1, 2022, a certified French translation must be attached to motions and other pleadings drawn up in English that emanate from a business or legal person that is a party to a pleading in Quebec. The legal person will bear the translation costs. The application of the provisions imposing this obligation has, however, been suspended for the time being by the Superior Court.7 As of September 1, 2022, registrations in the Register of Personal and Movable Real Rights and in the Land Registry Office, in particular registrations of securities, deeds of sale, leases and various other rights, must be made in French. Note that declarations of co-ownership must be filed at the Land Registry Office in French as of June 1, 2022. The lawyers at Lavery know Quebec’s language laws and can help you understand the impact of Bill 96 on your business, as well as inform you of the steps to take to meet these new obligations. Please do not hesitate to contact one of the Lavery team members named in this article for assistance. We invite you to consult the other articles concerning the modifications made to Quebec’s Charter of the French language: Trademarks and Charter of the French language: What can you expect from Bill 96? Amendments to the Charter of the French Language: Impacts on the Insurance Sector “Francization” refers to a process established by the Charter of the French language to ensure the generalized use of French in businesses. The OQLF is the regulatory body responsible for enforcing the Charter of the French language. The civil administration in this law includes any public body in the broad sense of the term. An employee who signed an individual employment contract before June 1, 2022, will have until June 1, 2023, to ask their employer to provide them with a French translation if the employee so wishes. If the individual employment contract is a fixed-term employment contract that ends before June 1, 2024, the employer is not obliged to have it translated into French at the request of the employee. Employers have until June 1, 2023, to have job application forms, documents related to work conditions and training documents translated into French if these are not already available to employees in French. Among these exceptions are employment contracts, loan contracts and contracts used in “relations with persons outside Quebec.” There seems to be a contradiction in the law with regard to individual employment contracts which are contracts of adhesion and for which the obligation to provide a French translation nevertheless seems to apply. Mitchell c. Procureur général du Québec, 2022 QCCS 2983.

Earlier this month, Canadian Heritage Minister Pablo Rodriguez introduced Bill C-18 (Online News Act) in Parliament. This bill, which was largely inspired by similar legislation in Australia, aims to reduce bargaining imbalances between online platforms and Canadian news outlets in terms of how these “digital news intermediaries” allow news content to be accessed and shared on their platforms. If passed, the Online News Act would, among other things, require these digital platforms such as Google and Facebook to enter into fair commercial agreements with news organizations for the use and dissemination of news related content on their platforms. Bill C-18, which was introduced on April 5, 2022, has a very broad scope, and covers all Canadian journalistic organizations, regardless of the type of media (online, print, etc.), if they meet certain eligibility criteria. With respect to the “digital news intermediaries” on which the journalistic content is shared, Bill C-18 specifically targets online communication platforms such as search engines or social media networks through which news content is made available to Canadian users and which, due to their size, have a significant bargaining imbalance with news media organizations. The bill proposes certain criteria by which this situation of bargaining imbalance can be determined, including the size of the digital platform, whether the platform operates in a market that provides a strategic advantage over news organizations and whether the platform occupies a prominent position within its market. These are clearly very subjective criteria which make it difficult to precisely identify these “digital news intermediaries.” Bill C-18 also currently provides that the intermediaries themselves will be required to notify the Canadian Radio-television and Telecommunications Commission (“CRTC”) of the fact that the Act applies to them. The mandatory negotiation process is really the heart of Bill C-18. If passed in its current form, digital platform operators will be required to negotiate in good faith with Canadian media organizations to reach fair revenue sharing agreements. If the parties fail to reach an agreement at the end of the negotiation and mediation process provided for in the legislation, a panel of three arbitrators may be called upon to select the final offer made by one of the parties. For the purposes of enforceability, the arbitration panel’s decision is then deemed, to constitute an agreement entered into by the parties. Finally, Bill C-18 provides digital platforms the possibility of applying to the CRTC for an exemption from mandatory arbitration provided that their revenue sharing agreements meet the following criteria: Provide fair compensation to the news businesses for news content that is made available on their platforms; Ensure that an appropriate portion of the compensation would be used by the news businesses to support the production of local, regional and national news content; Do not allow corporate influence to undermine the freedom of expression and journalistic independence enjoyed by news outlets; Contribute to the sustainability of Canada’s digital news marketplace; Ensure support for independent local news businesses, and ensure that a significant portion of independent local news businesses benefit from the deals; and Reflect the diversity of the Canadian news marketplace, including diversity with respect to language, racialized groups, Indigenous communities, local news and business models. A bill of this scope will certainly be studied very closely by the members of Parliament, and it would not be surprising if significant amendments were made during this process. We believe that some clarifications would be welcome, particularly as to the precise identity of businesses that will be considered “digital information intermediaries” for the purposes of the Online News Act.