In a development that affects organizations offshoring the
processing of personal information, the Office of the Privacy
Commissioner of Canada has recently issued "Guidelines for
Processing Personal Data across Borders." The Guidelines are
intended to clarify how the Personal Information Protection and
Electronic Documents Act (PIPEDA) applies to
transfers of personal information to third parties outside of
Canada for processing.
The Guidelines indicate that "PIPEDA does not
prohibit organizations in Canada from transferring personal
information to a third party in another jurisdiction for
processing." However, they do note that, under
PIPEDA, organizations are responsible for the protection
of personal information including information transferred to third
parties under outsourcing agreements. While the information is
being processed by a third party, organizations are required to use
"contractual or other means to provide a comparable level of
protection." The Guidelines note that "comparable level
of protection" does not mean that the protections offered by
third parties are identical on all levels but rather that they
should be "generally equivalent."
The Guidelines also state that a "transfer" of
personal information is not the same as a "disclosure."
Unlike a disclosure, with a transfer, the personal information can
only be used for the purpose for which it was originally collected.
If it is, the Guidelines indicate that additional consent to the
transfer is not required.
The Privacy Commissioner's Guidelines also reference the
guidelines dealing with processing of financial data that have been
published by the Office of the Superintendent of Financial
Institutions (OSFI). They note that while the OSFI guidelines set a
high standard with respect to protection of sensitive financial
information by financial institutions, they can also serve as a
good benchmark for organizations involved in transferring sensitive
personal information across borders.
Finally, the Guidelines also reinforce the need for transparency
when dealing with personal information of Canadians. Organizations
that engage in transfer of personal information outside Canada
should advise their customers that this information may be sent to
another jurisdiction for processing and that it may be accessed by
courts, law enforcement and national security authorities of that
McCarthy Tétrault Notes:
As more businesses move to offshore parts of their operations,
the need to ensure sufficient protection of customer data becomes a
major issue. From a publicity and a legal standpoint, a leak of
personal information can be very harmful to businesses that collect
sensitive data from their customers.
At the pre-planning stages of any offshoring project,
organizations should ensure that any third parties potentially
handling this data comply with the organization's own internal
privacy guidelines and that the laws of the foreign jurisdiction
allow for such compliance. By referring to the OSFI guidelines, the
Guidelines suggest that the Office of the Privacy Commissioner will
expect organizations that transfer personal information to
international third parties for processing to meet a very high
standard of data protection.
In addition, organizations should review their privacy policies
to ensure they adequately inform customers that their personal
information may be sent to a foreign country for processing and may
be accessed by that jurisdiction's law enforcement and
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
Unfortunately, reasonable accommodation for employees in the workplace continues to be the source of significant litigation and even today we continue to see outrageous examples of employers behaving badly.
We are now beginning to see reported cases involving charges and subsequent fines laid against employers for failing to provide information, instruction and supervision to protect a worker from workplace violence.
On October 13, 2016, the Supreme Court of Canada denied leave to appeal an Ontario Court of Appeal decision which ordered an employer to pay a former employee 37 months of salary and benefits following termination.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).