On September 23, 2019, the Office of the Privacy Commissioner of Canada (OPC) announced that it was ending its Consultation on transfers for processing (Consultation) and that it will maintain the status quo set out in its 2009 Guidelines for processing personal data across borders (Guidelines) until the Personal Information Protection and Electronic Documents Act (PIPEDA) is reformed. In doing so, the OPC made clear that it sees the current act's protections as "clearly insufficient" and that it will make recommendations "to strengthen the protections in a future law".
In establishing the Consultation, the OPC had proposed a significant departure from its existing interpretation of how PIPEDA applies to transfers of personal information to third parties for processing (see our prior bulletins on both Consultation documents: Privacy Commissioner of Canada Reverses Position on Transfers of Personal Information for Processing, Initiates Consultation on Cross-border Transfers and OPC Reframes Consultation on Transfers for Data Processing). In the Consultation documents, the OPC noted its intention to reclassify transfers of personal information as disclosures requiring consent rather than uses where if personal information "is used for the purpose it was originally collected, additional consent for the transfer is not required". Under the OPC's proposed interpretation of PIPEDA, "[i]ndividuals must be given the opportunity to exercise their legal right to consent" to transfers to third parties for processing.
We are well into the online and cloud computing eras and organizations that process personal information often rely on service providers to help process this information on their behalf. The OPC's proposed interpretation was met with concern from industry and from privacy professionals. The OPC noted that it received 87 submissions to the Consultation, and that "[t]he vast majority took the view there was no requirement under [PIPEDA] to seek consent for transfers for processing". Along those lines, the CBA Privacy and Access Law section summarized: "In our view, the principle of consent does not apply to transfers for processing that are subject to [PIPEDA]... It should not, in our view, be altered now."
The OPC noted that it is applying a "pragmatic approach in determining that it will maintain the status quo until the law is changed". Innovation in technology and business since PIPEDA was enacted can require that PIPEDA be applied to changing circumstance, but there is always a risk that new interpretations of core elements of unchanged legislation will have significant consequences for those who have built business processes around existing interpretations. The end of the Consultation and the re-affirmation of the Guidelines will be welcomed by most organizations, as the Guidelines have become a fixture of Canadian privacy law on which many business processes across all industries rely.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
