Kristen Pennington

Kristen Pennington maintains a dynamic practice in privacy, data protection and employment law. She assists emerging and established companies across a range of industries, including manufacturing, retail, food & beverage, and technology, and provides insights into Canada’s distinct laws in these disciplines to support businesses entering or investing in the Canadian market.

Kristen counsels clients on a wide variety of privacy and data security issues, including cross-border transfers of personal information, preventing and responding to data breaches, and evaluating the privacy law implications of new products, services, technologies and initiatives. She helps clients develop robust privacy compliance programs, including policies governing employees’ handling of personal information, data subject rights requests and vendor management, and frequently drafts privacy policies, cookie banners, consent forms, acceptable use policies and privacy and data protection terms in an array of commercial agreements.

Working with employers, Kristen advises on employee privacy issues, including conducting background checks, developing employee privacy policies, collecting employees’ personal information during a pandemic, and selecting and engaging payroll and other service providers who handle employees’ personal information.

Kristen has assisted vendors and purchasers with assessing the employment and privacy law implications of corporate transactions. She also regularly collaborates with international counsel to advise on the Canadian privacy and/or employment law considerations of multijurisdictional projects.

Co-author of the Canadian chapters of the 2021 and (forthcoming) 2022 International Comparative Legal Guides to Cybersecurity and Data Protection, Kristen regularly speaks and writes about emerging privacy and data protection issues, including vaccine passports, digital credentials, data breaches and forthcoming changes to Canada’s privacy laws.