On August 6, 2019, members of BLG’s Privacy and Data Protection Group submitted an official response to the call for comments issued by the Office of the Privacy Commissioner of Canada (OPC) in its “Consultation on transfers for processing – Reframed discussion” document dated June 11, 2019 (the Consultation). The Consultation reframed its original consultation on transborder dataflows dated April 9, 2019. The April 9 consultation was prompted by a decision in which the OPC, in a significant departure from its guidelines and decisions under the Personal Information Protection and Electronic Documents Act (PIPEDA), introduced a requirement for an organization to obtain consent for outsourcing activities involving personal information to a service provider outside of Canada. The OPC is taking the position that consent from individuals is required prior to any transfer of their personal information across a provincial or national border, including for mere processing purposes. We reported on the OPC’s revised policy position in our earlier bulletin “Important Privacy Commissioner Consultation Impacting Cross-Border Dataflows and Outsourcing”.
BLG’s submission incorporates the positions and concerns of our clients, who operate businesses in various industries that are impacted by the present Consultation. We have submitted that the revised position be reconsidered by the OPC and have detailed our reasoning in our response.