On September 23, 2019, the Office of the Privacy Commissioner of Canada (OPC) concluded its consultation on transfers for processing, initially launched on April 9, 2019. Fortunately, the OPC has determined that its approach to transfers of personal information to service providers for processing, as outlined in its 2009 guidelines for processing personal data across borders (2009 Policy Position), will remain unchanged under the current law.
The consultation on transfers for processing arose as a result of the OPC's proposed reversal in its long-held position that a transfer of personal information to a service provider for processing was a "use" of personal information by the transferring organization and not a "disclosure" to the service provider, and therefore no consent for the transfer was required; the OPC instead proposed that a transfer of personal information to a service provider for processing constitutes a disclosure of personal information for which consent must be obtained. For more information about the OPC's consultation on transfers for processing, see our April 2019 Blakes Bulletin: OPC Proposes a Reversal in its Approach to Transfers of Personal Information to Service Providers for Processing.
During its consultation, the OPC received 87 submissions from stakeholders raising concerns about the proposed shift in position. The vast majority of stakeholders took the position that the Personal Information Protection and Electronic Documents Act (PIPEDA) does not require consent to transfer personal information to a service provider for processing and highlighted the "enormous challenges" such a requirement would create for businesses.
The OPC conceded that more than one interpretation of PIPEDA was possible. It also recognized that the Federal Court of Appeal has mandated a flexible, common sense and pragmatic approach to interpreting Schedule 1 of PIPEDA, given its non-legal drafting. The OPC applied this "pragmatic approach" to conclude that its 2009 Policy Position will remain unchanged until the law is amended.
While the OPC's position on transfers for processing remains unchanged, the OPC did take the opportunity to remind businesses of the legal requirement to be transparent about personal information handling practices. As set out in the 2009 Policy Position, organizations should advise individuals if their personal information will be sent to another jurisdiction for processing and should explain that while personal information is in another jurisdiction it may be accessed by the courts, law enforcement and national security authorities. The OPC also reminded organizations of their obligation to continue to apply the Guidelines for Obtaining Meaningful Consent, which came into force on January 1, 2019.
For permission to reprint articles, please contact the Blakes Marketing Department.
© 2019 Blake, Cassels & Graydon LLP.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.