Every company is required by law to have a board of directors. The board is responsible for the overall direction of the company and for making major decisions, such as hiring and firing senior management, approving a budget and keeping the company financed through equity investments and debt financing. [1] Therefore, building a strong, effective board of directors is very important for your company’s success.
There are some considerations when building the board of directors for a startup.
Have The Right Number Of Members
At the early stage, 3-5 directors are appropriate number for a new company. Too many directors at this stage will make scheduling an issue and be a drain on your funds. Generally, after the initial seed round, the company will have to allocate a board seat to the corporation which has led that seed round. If the founders still want to keep control of the board, it is better for them to retain two seats and the new investor to have one seat. It should be noted that when you accept a new investor, you might have to allocate a new board seat for it. Thus, if you do not want a certain person on the board, you’d better refuse that person’s investment.
At some point, if the board is getting too big or if the investment size doesn’t merit a board seat, instead of giving out more board seats, the company might allow investors to act as “observers.” That is, they can come to and participate in the board meetings, but they do not get a formal vote.[2]
In order to avoid a tie vote, you are highly recommended to have an odd number of board members.
Create A Diverse Board
Establishing a board of directors with different knowledge, expertise, age and backgrounds can be a powerful force for your company's success. A diverse board can provide the company with unique perspectives. You might need a marketing expert, a financial expert, and an exit expert on the board, as well as an advisor who might help guide decisions and aid in negotiations.[3]
Provide Good Compensation For Directors
Compensation is essential, so keep that in mind and consider giving them access to a percentage of stock instead of money. A common amount given is 1 percent of stock or expenses per quarter plus a meager retainer.[4]
Choose People Who Can Participate Fully And Share The Same Vision For The Company
It is important to have board members who can dedicate significant time to the company. The board members should not just be available for scheduled meetings, they should also be available when urgent issues arise. Thus, it is better to have board members who are in close proximity to the company as you can meet face to face when some important issues emerge.
Please keep in mind to establish a board of directors who share the same vision and long-term goals for the company. If the members have different vision, the probability of risk of pulling the company in opposite directions will increase.
Have Independent Directors
An independent director is not a founder or an investor or an employee of the company. Appropriate independent directors can bring their previous business and operating experience to the company. They can also provide the company with their contacts which might be a great asset for the company. However, you should always have independent directors who can establish a long-term relationship with the company and who would like to dedicate significant time to the company. It would be great if the independent directors can provide hands-on mentorship.
 
Rong Gao is a member of the BLG Business Venture Clinic and is a second-year law student at the Faculty of Law, University of Calgary.
 
References
[1] Samer Hamadeh, Adam Dinow, What you need to know about startup boards, https://techcrunch.com/2016/11/05/what-you-need-to-know-about-startup-boards
[2] Ibid.
[3] Alejandro Maher, Build Board of Directors: Simple How To Guide for Startups, https://www.upcounsel.com/build-board-of-directors-simple-how-to-guide-for-startups
[4] Ibid.

​According to the Canadian federal government Canada has more computers per capita than any other country worldwide. Canadians are also the heaviest internet users worldwide with the average Canadian spending 40 hours online per month. However, our collective internet use comes with risks to both individuals and business. In fact, 70% of Canadian businesses have been victims of a cyber-attack.
​
Therefore, it is crucial that Canadian businesses are aware of their responsibilities regarding how to handle personal information of their users.
PIPEDA is the Personal Information Protection and Electronic Documents Act. This federal privacy law for private-sector organizations outlines the ground rules for how businesses must handle personal information in the course of their commercial activity. PIPEDA applies to private sector organizations in Canada that process personal information in the course of commercial activity. All businesses operating in Canada and handle information that cross Canadian provincial or national borders are subject to PIPEDA.
In a 2017 holding the Federal Court of Canada has found that PIPEDA will apply to businesses established outside of Canadian jurisdictions as long as “real and substantial connection” exists between a business’s activity and Canada. This effectively includes all Canadian startups.
Factors include:

• Targeting of promotional efforts to a Canadian audience
• Location of end users
• Source of content
• Location of operator
• Location of host server

In general, businesses have no legal obligation to register with or notify the relevant data protection authorities in respect to processing activities. But when businesses collect data as well as process it then they have to be aware of the rights that individuals retain with respect to their data.

• Individuals have the right to:
  • Access to their data/copies of data
  • Rectification of errors in data
  • Withdrawal of consent
  • Right to complain to relevant data protection authorities
• Individuals do not have the explicit right to:
  • Deletion/right to be forgotten
  • Object to processing
  • Data portability

PIPEDA has 10 key principles that guide how businesses should handle their users data. I have outlined them below.

1. Transparency (openness) = organizations are to document and make available to individuals in an accessible form information about their policies and practices relating to data management of personal information.
2. Meaningful Consent = Under PIPEDA organizations must generally obtain an individual’s consent when they process that individual’s personal information. People have the right to access their personal information held by an organization. They also have the right to challenge the accuracy of this information. As of January 1st, 2019 the Guidelines for Obtaining Meaningful Consent are in effect (GOMC). The GOMC is intended to improve the existing consent model under PIPEDA. The GOMC was jointly issued with the offices of Information and Privacy Commissions in Alberta and British Columbia.

The GOMC emphasize the following elements:

1. Key Elements being collected
   1. Personal information being collected
   2. With whom personal information is shared (parties)
   3. Purpose of collection, use and disclosure (collectively known as “processing”)
   4. Risk of collection, use and disclosure
2. Allow individuals to control the level of detail they get and when
3. Provide individuals with clear binary choices when asking permission to collect, use or disclose data (yes or no questions)
4. Be innovative and creative
5. Consider the consumer’s perspective
6. Make consent a dynamic and ongoing process
7. Be accountable: Stand ready to demonstrate compliance

 

1. Purpose limitation = organizations are required to identify the purposes for which information is collected before at collection itself. Indiscriminate collection without purpose is not permitted. Information may only be used for the purpose it was collected and not beyond that scope.
2. Data minimization = Information may only be collected as to fulfill the purpose of the objective of collection and not beyond it.
3. Proportionality = Overriding obligation that organizations may only process information for purposes that a reasonable person would consider appropriate in the circumstances.
4. Retention = (linked to data minimization) information may only be retained for as long as it is required to fulfill the purpose of collection
5. Accountability = Organizations are responsible for protecting personal information under their control including personal information that they transfer to third parties for processing. Organizations must identify an individual who is responsible and accountable for ensuring compliance with the privacy principles. This person is the ‘Data Protection Officer’. This is expressly required by PIPEDA, PIPA Alberta and PIPA BC. Interestingly, no sanctions exist for not appointing a privacy officer.
6. Safeguarding = Canadian privacy statutes contain specific provisions relating to the safeguarding of personal information. This includes provisions that require organizations to implement reasonable technical, physical and administrative measures to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, modification or destruction.

 
PLEASE NOTE:

• PIPEDA does not apply to personal information held by federal government organizations
• Not-for-profit, charity groups or political parties.

 
Appointment of Processors
Under PIPEDA any organization is required to use contractual or other means to provide a comparable level of protection while the information is being processed by a third party. The failure to have appropriate confidentiality agreements in place with third party contractors has been found to be a breach of the accountability principle.  These agreements do not have specific provisions or requirements. The industry standard is an acceptable metric (i.e. industry standard for health data).
Transferring Data Outside of Canada
PIPEDA generally permits even non-consensual transfer of data outside of Canada provided the organizations use contractual or other means to provide a comparable level of protection while the information is being processed by a third party. However, it is good practice and required by some jurisdictions (Alberta) that if an organization uses a data processor outside of Canada they specify the foreign jurisdictions in which the transfer is taking place and for what purposes the foreign service provider has been authorized to process data on their behalf.
Notice of Breach
PIPEDA underwent a number of amendments in 2015. This included a three-pronged notice requirement in the event of a security breach. The three include:

1. A report to the Office of the Privacy Commissioner of Canada
2. A notice to affected individuals
3. A notice to other organizations

PIPEDA’s breach notification provisions require an organization to notify affected individuals of a breach of security safeguards if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual. The notification must be given as soon as feasible after the organization determines that the breach has occurred. The contents of the notification to individuals will have to include:
A. a description of the circumstances of the breach;
b. the day on which, or period during which, the breach occurred or, if neither is known, the approximate period;
c. a description of the personal information that is the subject of the breach to the extent that the information is known;
 d. a description of the steps that the organization has taken to reduce the risk of harm that could result from the breach;
Failure to report a breach or to maintain records as required is an offence under PIPEDA, punishable by a fine of up to C$100,000.
Conclusion:
Businesses, especially startups, should proactively conduct an audit of their existing consent policies and practices in order to ensure they are compliant with the new GOMC. Businesses should be ready and prepared to demonstrate compliance with PIPEDA in particular relating to these new consent requirements. Periodic review and reassessment of best practices is also highly recommended.
 
 
 
 

You have started a business and have decided to raise capital by issuing equity. You want to incentivize early investment so you offer to protect potential shareholders’ shares by creating A Shareholders’ Agreement that would ensure their ownership stake is protected. A Right of First Refusal (“ROFR”), Pre-emptive Rights, or Piggyback Rights seem like the perfect forms of protection and incentive. However, if you are not careful, they can create overly restrictive share transfer abilities and discourage future investment. If you want to impose restrictions on the ability to transfer shares, then it is important that you understand the purpose of those restrictions and how you can draft them so they are not overly restrictive.
 
Rights of First Refusal
A ROFR requires any shareholder intending to sell their shares (“Intending Shareholder”) to first offer them to their fellow shareholders or the company[1]. ROFRs also grant shareholders the ability to control who their fellow shareholders are. It is a reasonable device to prohibit the sale of shares to competitors as long as it is not too onerous or time-consuming.
 
There are two kinds of ROFRs. The first kind, a Hard ROFR requires the Intending Shareholder to acquire a bona fide offer from a third party to acquire their shares before shares are offered to fellow shareholders.[2] The second kind of ROFR is a soft ROFR, which permits the Intending Shareholder to first offer the shares to the other shareholders, and then, if not taken up, offer them to third parties at the price offered to the other shareholders or higher.[3]
           
Hard ROFRs can make it difficult for shareholders to sell their shares because a potential third-party investor can easily lose a deal. Soft ROFRs are less restrictive because they must be exercised before any potential third-party purchaser is identified. If a ROFR is going to be included in a Shareholders’ Agreement, a Soft ROFR would provide more flexibility for shareholders to sell their shares.[4] Further, regardless of what sort of ROFR is implemented, the ability for shareholders to sell a certain percentage of their shares before the ROFR is triggered is a reasonable and effective addition to a ROFR.
 
Pre-emptive Rights
Pre-emptive Rights provide current shareholders with the right to participate in future financing and are frequently included in early-stage Shareholders’ Agreements. This right to buy future shares can be used to protect early investors’ shares from being diluted when a company decides to issue more shares.[5]
 
While the use of Pre-emptive Rights can be beneficial to shareholders, it can also serve as an obstacle to a company looking to attract investment from outside investors. The injection of non-professional investors into financing can result in an inability to provide a workable structure that includes Venture Capitalists, and as a result, stunt the growth rate or ability of a company.
 
If Pre-emptive Rights are to be used, they should be accompanied by either or both a Sunset Provision and a Pay to Play Provision. A Sunset Provision would provide the Pre-emptive Rights only for the period the shares are cheap and early stage capital is being raised.[6] In other words, the Pre-emptive Rights Provision would terminate after a certain period of time (For example: two years after the execution of the Shareholders’ Agreement). A Pay to Play Provision requires existing investors to invest on a pro rata basis in subsequent financing rounds or they will forfeit certain or all preferential rights.[7] This discourages the strategic use of Pre-emptive Rights in future financing rounds.
 
Piggyback Rights[8]
A Piggyback Right requires that an Intending Shareholder permit other shareholders to sell their shares along with it on a pro rata basis. The rational for this device is to ensure that shareholders with this benefit can exit a company at the same time and rate as the shareholder subject to the right. The issue with a Piggyback Right is that it can delay and drag out potential sales of shares because they require a notice period (to the other shareholders), and a buyer for more than one shareholder’s shares must be found. This can discourage not only potential buyers, but also shareholders, due to the difficult tasks of finding purchaser(s).

​Piggyback Rights should be used with caution, and potentially limited to irreplaceable executives and majority shareholders.[9] It shouldn’t matter if an indifferent shareholder decides to sell their shares, however, if an executive shareholder decides to sell all their shares, then other shareholders should have to opportunity to sell their shares as well as this could be an indication that the company’s value is going to decline.
 
Conclusion
Many forms of restrictions on the ability to transfer shares exist. ROFRs, Pre-emptive Rights and Piggyback Rights are but a few such restrictions that can be used to protect shareholders. However, if these provisions are included in Shareholders’ Agreements without understanding how they may implicate the ability to transfer shares, it can halt a company’s ability to attract investment in the future. If restrictions are to be imposed on the ability to transfer shares, they should be included in a manner that does not make their application absolute and avoids barriers that make the ability to transfer shares too onerous or impossible.
 
For more information contact the BLG Venture Clinic.
 
Suleiman Semalulu is member of the BLG Venture Clinic and is a third-year law student at the Faculty of Law, University of Calgary.

References
[1] Bryce Cyril Tingle, Start-up and Growth Companies in Canada: A Guide to Legal and Business Practice, (Canada: LexisNexis, 2018) [Tingle].
[2] Sara C. Pender, “Canada: Five Beneficial Clauses To Consider When Drafting A Shareholders’ Agreement” (July 19, 2013), online (blog): Mondaq < http://www.mondaq.com/canada/x/252080/Shareholders/Five+Beneficial+Clauses+To+Consider+When+Drafting+A+Shareholders+Agreement>.
[3] Ibid.
[4] Tingle, supra note 1.
[5] Joshua Kennon,” Understanding Shareholders Pre-emptive Rights” (February 8, 2019), online (blog): Investing for Beginners < https://www.thebalance.com/what-is-the-preemptive-right-358100>
[6] Tingle, supra note 1.
[7] Ibid.
[8] Ibid; Shanlee von Vegasack, “A Brief Introduction to Unanimous Shareholder Agreements” online (blog): BD&P < https://www.bdplaw.com/content/uploads/2016/06/Shareholders-Agreements.pdf>.
[9]  Tingle, supra note 1.

So you’ve made the decision that incorporation is right for your business, but there’s another critical incorporation decision ahead – where do you incorporate? In Alberta, incorporation is governed by the Business Corporations Act (the “ABCA”).[1] Federal incorporation is governed by the Canada Business Corporation Act (the “CBCA”).[2] There are a number of factors differentiating provincial and federal incorporation to guide your decision.
Fees
The cost of provincial incorporation is $275 plus service fees.[3] The cost of federal incorporation is $200 for online applications or $250 for paper applications.[4]
While incorporating a federal corporation appears less costly in terms of incorporation fees, there is an additional cost consideration for a business seeking to incorporate federally – federal corporations are also required to extra-provincially register in the provinces in which they will carry on business. The definition of “carry on business” triggering the extra-provincial registration requirement includes running a business, having an address, post box or phone number, or offering products and services for a profit.[5] The fee to register an extra-provincial corporation in Alberta is $275 plus service fees.[6]
Address
The ABCA requires a business to have its registered office in Alberta.[7] The requirement to have a registered office in Alberta is not satisfied by merely having a post office box in Alberta.[8] The requirement is a physical address in Alberta accessible during normal business hours.[9] The ABCA requires shareholder meetings to be held in Alberta unless all shareholders entitled to vote at the meeting agree to hold it outside of Alberta.[10]
The CBCA allows a federally incorporated business to have a registered office and hold annual meetings in any province in Canada.[11]
Filing Requirements
The CBCA entails additional paperwork by requiring a corporation to file annual returns.[12] Current annual federal filing fees are $20 (online) or $40 (paper filing).[13] The filing requirements must be completed annually, whether or not there have been director or address changes for the corporation.
The ABCA has its own annual return requirements.[14] These requirements also apply to registered extra-provincial corporations.[15] A federal corporation registered in Alberta will have to file annual returns under the ABCA to comply with the statute. A corporation operating in Alberta has more onerous filing requirements if it incorporated federally as opposed to provincially.
Name Protection
Federal incorporation allows a business to use its corporate name across Canada.[16] This degree of name protection can only be defeated by a trademark. Federal name searches are therefore more rigorous than provincial name searches.
Provincial incorporation only allows a business to use its corporate name in Alberta, and a corporation will need to conduct a name search in each additional province in which it wishes to carry on business. There is a risk that its corporate name will be rejected in another province, requiring the use of an alternative name.
Privacy
Corporations Canada maintains a register of the Registered Office Address, Directors, Annual Filings, and Corporate History of federal corporations, publicly available online at no cost.[17] Provincial corporations have relative privacy with respect to the accessibility of their corporate data, as such information from provincial corporations is not publicly available online, and a fee is required for a search.
Structure
The ABCA permits the establishment of Unlimited Liability Corporations – this is an unusual incorporation structure that makes the liability of shareholders unlimited in extent and joint and several in nature.[18] This structure is not supported by the CBCA.
Prestige
Federal incorporation may have the advantage of prestige from global recognition standpoint, as a Canadian corporation is more recognizable than individual provinces. [19] This is primarily a consideration for businesses intending to operate internationally.
Ultimately, a corporation is not permanently confined to the jurisdiction in which it was originally incorporated. A corporation can choose to change from provincial to federal incorporation, vice versa, or from one province to another, by way of a continuance. Both the ABCA and the CBCA contain provisions allowing corporations from another jurisdiction to effectively re-incorporate under their statute.[20]

For further assistance with incorporating under the ABCA or the CBCA, contact the BLG Business Venture Clinic. We can assist with drafting articles and bylaws to get your corporation set up the right way and avoid costly changes down the road.
 
Ana Cherniak-Kennedy is a member of the BLG Business Venture Clinic and is a second-year law student at the Faculty of Law, University of Calgary.
 
References
[1] RSA 2000, c B-9 [ABCA].
[2] RSC 1985, c C-44 [CBCA].
[3] Open Alberta, “Registry agent product catalogue” (2019), online: Government of Alberta <https://open.alberta.ca/publications/6041328>.
[4] Corporations Canada, “Services, fees and turnaround times – Canada Business Corporations Act” (2017), online: Government of Canada <https://corporationscanada.ic.gc.ca/eic/site/cd-dgc.nsf/eng/cs06650.html>.
[5] Corporations Canada, “Steps to Incorporating” (2016), online: Government of Canada <https://corporationscanada.ic.gc.ca/eic/site/cd-dgc.nsf/eng/cs06642.html#toc-06>.
[6] Service Alberta, “Registry agent product catalogue” (2019), online: Government of Alberta <https://open.alberta.ca/publications/6041328>.
[7] ABCA, s 20.
[8] ABCA, s 20(4).
[9] ABCA, s 20(6).
[10] ABCA, s 131.
[11] CBCA, s 19(1).
[12] CBCA, s 263.
[13] Corporations Canada, “Policy on filing of annual returns – Canada Business Corporations Act” (2012), online: Government of Canada <https://www.ic.gc.ca/eic/site/cd-dgc.nsf/eng/cs02544.html>.
[14] ABCA, s 268.
[15] ABCA, s 292.
[16] Corporations Canada, “Is incorporation right for you?” (2016), online: Government of Canada <https://www.ic.gc.ca/eic/site/cd-dgc.nsf/eng/cs06641.html>.
[17] Corporations Canada, “Search for a Federal Corporation” (2019), online: Government of Canada <https://www.ic.gc.ca/app/scr/cc/CorporationsCanada/fdrlCrpSrch.html>.
[18] ABCA, s 15.2(1).
[19] Corporations Canada, supra note 20.
[20] ABCA, s 188; CBCA, s 197.