The Privacy Commissioner of Canada (OPC) announced on September 23, 2019 that it has concluded its consultation on transfers for processing of personal information, and that it will not be changing its guidance and requirements for such transfers under the Personal Information Protection and Electronic Documents Act (PIPEDA). There are therefore no new obligations for organizations that engage in transfers for processing either within or outside Canada, and these organizations must only ensure that they continue to follow the OPC’s Guidelines for obtaining meaningful consent and Guidelines for processing personal data across borders. In particular, for cross-border transfers, organizations should notify individuals if their information will be sent to another jurisdiction for processing, and that once their information is transferred it could be accessed by law enforcement agencies, courts or national security authorities of that jurisdiction.
As we outlined in our earlier bulletin “Important Privacy Commissioner Consultation Impacting Cross-Border Dataflows and Outsourcing”, the OPC took the position in its recent Report of Findings regarding its investigation into Equifax and its consultation discussion document published in April 2019 that consent from individuals was required prior to transferring their personal information across provincial or national borders for processing. In its announcement, the OPC indicated that it received 87 submissions in response to the consultation from stakeholders, many of whom argued that PIPEDA contains no requirement to obtain consent prior to transfers for processing, and that requiring consent in these situations would present “enormous challenges for their business processes”.
Although the OPC considers that PIPEDA is insufficient for protecting privacy in the context of transfers for processing, it has decided that it will maintain the current guidelines and requirements for these transfers until the law is updated. In May, the federal government announced as part of its Digital Charter that it was beginning the process of updating PIPEDA. The OPC indicated that it will take the submissions that it received into account as it formulates its recommendations for the federal government with regards to how the law can be updated and strengthened.