improper conduct by an individual, that is directed at and offensive to another individual in the workplace, including at any event or any location related to work, and that the individual knew or ought reasonably to have known would cause offence or harm. It comprises objectionable act(s), comment(s) or display(s) that demean, belittle, or cause personal humiliation or embarrassment, and any act of intimidation or threat. It also includes harassment within the meaning of the Canadian Human Rights Act (. based on race, national or ethnic origin, colour, religion, age, sex, sexual orientation, marital status, family status, disability and pardoned conviction).
The original proposal also dictated that the legislation would in theory "apply for all non-. companies without any establishment in the ., provided that the processing of data is directed at . residents," one of the biggest changes with the new legislation.  This proposed change carried on through to the legislation's final approval on 14 April 2016, potentially affecting entities around the world. "The Regulation applies to processing outside the EU that relates to the offering of goods or services to data subjects (individuals) in the EU or the monitoring of their behavior," according to W. Scott Blackmer of the InfoLawGroup, though he added "[i]t is questionable whether European supervisory authorities or consumers would actually try to sue US-based operators over violations of the Regulation."  Additional changes include stricter conditions for consent, broader definition of sensitive data, new provisions on protecting children's privacy, and the inclusion of "rights to be forgotten."