1.1 For the purposes of this DPA, the following expressions bear the following meanings unless the context otherwise requires:
“Applicable Data Protection Laws” means, in respect of a Party, any law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding instrument relating to the protection of Personal Data, including:
(a) the Directive 2002/58/EC (as amended) (the “e-Privacy Directive”), the e-Privacy Regulation 2017/003 (COD) (the “e-Privacy Regulation”), and any laws and regulations implementing these;
(b) the Directive 95/46/EC (as amended) (the “Data Protection Directive”), the Regulation 2016/679 (the “GDPR”), and any laws and regulations implementing these; and
(c) Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (the “Quebec Privacy Act”) as amended by Law 25;
(in each case as amended, consolidated, re-enacted or replaced from time to time).
“Data Subject”, “Personal Data”, “Process”, “Processed” and “Processing” shall each have the meaning as set out in the GDPR. Processing shall also mean to “collect, hold, use or communicate to third parties” as found in the Quebec Privacy Act. Personal Data shall also mean “personal information” as found in the Quebec Privacy Act;
“EU Data Protection Laws” means any law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding instrument relating to the protection of personal data in force in the territory of the European Union, including the Data Protection Directive, the GDPR, the e-Privacy Directive and the e-Privacy Regulation;
“Model Clauses” mean the Standard Contractual Clauses between controllers and processors under Article 28 (7) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29 (7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council, as adopted by the European Commission Implementing Decision of June 4, 2021; or alternatively the Standard Contractual Clauses (Controller to Processor) as set out in the European Commission Decision of 5 February 2010 (C (2010) 593), until such time as they are no longer valid on December 27, 2022;
“Regulator” means the data protection supervisory authority which has jurisdiction over a Data Controller’s Processing of Personal Data. This includes but is not limited to the Commission d’accès à l’information in Quebec;
“Third Countries” means all countries outside of the scope of the data protection laws of the European Economic Area (“EEA”) and the United Kingdom, excluding countries approved as providing adequate protection for Personal Data by the European Commission from time to time, which at the date of this DPA include Andorra, Argentina, Canada (commercial organizations only), Faroe Islands, Guernsey, Isle of Man, Israel, Japan, Jersey, New Zealand, Switzerland, and Uruguay.
Any capitalized terms used but not defined herein shall have the meaning given to them in the Agreement.