In Canada, the Personal Information Protection and Electronic Documents Act, or PIPEDA, requires an organization to obtain a consumer’s consent to collect, use or disclose personal information. Under this act, consumer personal information may be used only for the purposes for which it was collected. We allow our customers to voluntarily “opt out” from receiving either one or both promotional and marketing mail or promotional and marketing electronic mail. Heightened consumer awareness of, and concern about, privacy may result in customers “opting out” at higher rates than they have historically. This would mean that a reduced number of customers would receive bonus and promotional offers and therefore those customers may collect fewer AIR MILES reward miles.
Canada’s Anti-Spam Legislation, or CASL, may restrict our ability to send “commercial electronic messages,” defined to include text, sound, voice and image messages to email, or similar accounts, where the primary purpose is advertising or promoting a commercial product or service to our customers and prospective customers. CASL requires, in part, that a sender have consent to send a commercial electronic message, and provide the customers with an opportunity to opt out from receiving future commercial electronic email messages from the sender.
On May 25, 2018, The General Data Protection Regulation, or GDPR, a European Union-wide legal framework to govern data collection, use and sharing and related consumer privacy rights came into force. The GDPR replaced the European Union Directive 95/46/EC and applies to and binds the 27 EU Member States. The GDPR details greater compliance obligations on organizations, including the implementation of a number of processes and policies around data collection and use. These, and other terms of the GDPR, could limit our ability to provide services and information to our customers. In addition, the GDPR includes significant new penalties for non-compliance.
In general, GDPR, and other European Union and Member State specific privacy and data governance laws, could also lead to adaptation of our technologies or practices to satisfy local privacy requirements and standards that may be more stringent than in the U.S. Similarly, it is possible that in the future, U.S. and foreign jurisdictions may adopt legislation or regulations that impair our ability to effectively track consumers’ use of our advertising services, such as the FTC’s proposed “Do-Not-Track” standard or other legislation or regulations similar to EU Directive 2009/136/EC, commonly referred to as the “Cookie Directive,” which directs EU Member States to ensure that accessing information on an internet user’s computer, such as through a cookie, is allowed only if the internet user has given his or her consent. On January 31, 2020, the United Kingdom left the European Union and entered into a Brexit transition period. During this period, which runs until the end of December 2020, the GDPR will continue to apply to the United Kingdom. It is not yet known what the data protection landscape will look like at the end of the transition period.
There ishas also been rapid development of new privacy laws and regulations elsewhere around the globe, including amendments of existing data protection laws, to the scope of such laws and penalties for noncompliance. Failure to comply with these international data protection laws and regulations could have a negative impact on our reputation and subject us to significant penalties.
While all 50 U.S. statesCompliance with current or future privacy, data protection and the District of Columbia have enactedinformation security laws and regulations (including those regarding data breach notification and consumer privacy) affecting customer, employee or other data to which we are subject could result in higher compliance and technology costs and could restrict our ability to provide certain products and services (such as products or services that involve us sharing information with third parties or storing sensitive credit card information), which could materially and adversely affect our profitability. Our failure to comply with privacy, data protection and information security laws there is no such U.S. federal law generally applicableand regulations could result in potentially significant regulatory investigations and government actions, litigation, fines or sanctions, consumer or partner actions, decreases in the use of our cards and damage to our businesses. Data breach notification legislationreputation and regulations relating to mandatory reporting came into force in Canadaour brand, all of which could have a material adverse effect on November 1, 2018. Data breach notification laws have been proposed widelyour business, results of operations and exist in other specific countries and jurisdictions in which we conduct business. Legislative and regulatory measures, such as mandatory breach notification provisions, impose, among other elements, strict requirements on reporting time frames and providing notice to individuals.financial condition.
We also have systems and processes to complyHuman Capital
As of December 31, 2021, we employed approximately 6,000 associates worldwide, with the USA PATRIOT ACT of 2001, which is designed to deter and punish terrorist actsmajority concentrated in the United StatesStates. As a core component of our broader Environmental, Social and aroundCorporate Governance (ESG) and sustainability efforts, our key human capital management objectives are to attract, develop and retain top talent. To support these objectives, we take a holistic approach to our associates’ experiences as employees, recognizing that an engaged workforce drives our long-term growth and sustainability. Our Board of Directors and designated Board committees provide the world,important oversight of our human capital management strategy, including diversity, equity and inclusion, or DE&I, efforts, which are led by our head of diversity and inclusion and our Chief Diversity Officer, both appointed in 2021. In May 2021, our Board of Directors expanded the compensation committee’s responsibilities and duties to enhance law enforcement investigatory tools,more specifically include oversight of our management of human capital and, forin connection with these changes, the committee’s name was formally changed to the “Compensation & Human Capital Committee.” Our Compensation & Human Capital Committee, along with our Board of Directors, receive regular updates from senior management and third-party consultants on human capital trends and developments and other purposes.key human capital matters that drive our ongoing success and performance.
Ontario’s Protecting Rewards Points Act (Consumer Protection Amendment), 2016,Associate Wellbeing
With the ongoing impact of the global COVID-19 pandemic, approximately 95% of our total workforce continues to successfully work from home, and additional related regulations effective January 2018, prohibit suppliers from entering into or amending consumer agreementswith minimal business disruption. We have continued initiatives designed to connect, recognize and engage our workforce in a virtual work environment, including providing the necessary technology, support and lines of communication for our associates to be successful in their roles in this unique environment. Associate wellbeing remained a top priority in 2021, and we continued to provide timely reminders and access to numerous existing and new resources and support, including a particular focus on mental health awareness and counselling support. Other associate wellbeing resources include financial education and wellness courses, a variety of online fitness and meditation classes, a fitness cost reimbursement program and other benefits to promote mental and physical health and overall wellbeing. We surveyed our associates on our return-to-office plans and their work environment preferences, and we anticipate the majority of our workforce will continue to work remotely or on a hybrid basis for the expiryforeseeable future. For those associates who worked in the office during the year, or plan to return, our COVID taskforce has been focused on taking appropriate health and safety measures in our office space. We implemented a COVID testing solution beginning in 2022 to ensure those associates who are not vaccinated have the option to work in the office, while protecting the safety of rewards points dueall associates.
Additionally during 2021, we further improved the competitiveness of our associate benefit offerings, including implementing new paid time off and flex time off policies to provide additional flexibility for our associates, adding a new paid holiday (bringing the passage of time alone, while permitting the expiry of rewards points if the underlying consumer agreement is terminatedtotal to nine) and that agreement provides that reward points expire upon termination. Similar legislation pertaining to the expiry of rewards points due to the passage of time alone was passed in Quebec in 2017, with regulations taking effect in 2018 and 2019.offering new virtual benefit fairs, among other initiatives.
