ARTICLE
30 September 2019

Federal Privacy Commissioner Holds Steady On Processing Personal Information Across Borders

SB
Smart & Biggar

Contributor

Smart & Biggar uncovers and maximizes intellectual property and technology assets for our clients. Today’s fast-paced innovation economy demands a higher level of expertise and attention to detail when it comes to IP strategy and protection. With over 125 lawyers, patent agents and trademark agents collaborating across five Canadian offices, Smart & Biggar is trusted by the world’s leading innovators to find value in their IP rights. As market leaders in IP, Smart & Biggar’s team is on the pulse when it comes to the latest developments and the wider industry changes that impact our clients. To stay informed, visit smartbiggar.ca/insights, including access to our RxIP Update (smartbiggar.ca/insights/rx-ip-updates), a monthly digest of the latest decisions and law surrounding the life sciences and pharmaceutical industries.
On September 23, 2019, the Office of the Privacy Commissioner of Canada (OPC) announced that its 2009 guidelines for processing personal data across borders
Canada Privacy

On September 23, 2019, the Office of the Privacy Commissioner of Canada (OPC) announced that its 2009 guidelines for processing personal data across borders will remain unchanged under the current law.

Earlier this year, the OPC released its Report of Findings on the Equifax investigation, where it determined, on the facts of the case, that consent was required under the current law for the transfer of personal information from Equifax Canada for processing by its US affiliate, Equifax Inc. Because this interpretation was a departure from the OPCs previous position on transfers for processing, the OPC accepted submissions from stakeholders during a consultation period. 

The OPC received 87 submissions. Stakeholders raised concerns with respect to the position that consent may be required for transfers for processing. The majority of the submissions took the view that there is no requirement under the Personal Information Protection and Electronic Documents Act (PIPEDA) to seek consent for this type of activity and that having to do so would create “enormous challenges” for their business processes. 

The OPC will maintain the status quo until the law is changed; however, it reminds organizations of the legal requirement to be transparent about personal information handling practices, including that organizations should advise customers that their personal information may be sent to another jurisdiction for processing and the potential consequences of that transfer. The OPC also reiterated its expectation that organizations apply the guidelines for obtaining meaningful consent (read our article here).

The OPC will now focus its efforts on how to modernize and reform PIPEDA to best protect Canadians’ privacy rights when their information is transferred between organizations.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More