Announcement

September 23, 2019

Commissioner concludes consultation on transfers for processing

Following a consultation on transfers of personal information for processing, the Office of the Privacy Commissioner of Canada (OPC) has concluded that its guidelines for processing personal data across borders will remain unchanged under the current law. The OPC will now focus its efforts on how a reformed law can best protect Canadians’ privacy rights when their information is transferred between organizations.

The OPC’s longer-term goal remains to ensure effective privacy protection in the context of transfers for processing, accepting that transborder data flows are the subject of international trade agreements and that both domestic and international transfers bring significant benefits to individuals and organizations.

During its consultation, the Office received 87 submissions. Stakeholders, including industry representatives, raised concerns with respect to the position that consent may be required for transfers for processing.

The vast majority took the view there was no requirement under the Personal Information Protection and Electronic Documents Act (PIPEDA) to seek consent for transfers for processing and that doing so would create enormous challenges for their business processes.

In our view, this is a not uncommon situation where more than one interpretation of the law is possible. The Federal Court of Appeal has mandated that due to PIPEDA’s “non-legal drafting” and the fact that the Act “is a compromise both as to substance and to form”, a special rule of interpretation applies. The Court has held that: “Schedule 1 (of PIPEDA) does not lend itself to typical rigorous construction. In these circumstances, flexibility, common sense and pragmatism will best guide the Court.”

The OPC is applying this pragmatic approach in determining that it will maintain the status quo until the law is changed. To this end, the Office took into consideration the submissions received and the fact that the proposed position is unlikely to be applied in practice until years in the future, likely well after legislation is reformed.

While the OPC’s position on transfers for processing remains unchanged, we remind businesses of the legal requirement to be transparent about personal information handling practices. Organizations should advise customers that their personal information may be sent to another jurisdiction for processing and that while the information is in another jurisdiction it may be accessed by the courts, law enforcement and national security authorities.

As well, the OPC expects organizations to continue to apply its guidelines for obtaining meaningful consent to allow individuals to make informed decisions as they are considering using the service or product on offer, making the purchase, or downloading the app. The guidelines indicate that organizations, including those that rely on third-party processors, should emphasize key elements in their privacy notices: what personal information is being collected; with which parties personal information is being shared; for what purposes personal information is collected, used or disclosed; and any residual meaningful risk of harm or other consequences.

As it develops recommendations for modernizing Canada’s federal private sector law, the OPC will take into consideration the submissions it has received that speak to legislative reform and how a future law could address transfers for processing and transborder data flows to effectively protect privacy.

Transfers for processing and cross border data flows can create significant benefits for consumers and organizations. One of PIPEDA’s purposes is to support and promote electronic commerce. However, these transfers create inherent risks for privacy that must be addressed through robust legal protections. In our view, existing privacy protections are clearly insufficient and we will be making recommendations to strengthen the protections in a future law.