BC Attempts to Regulate International Outsourcing of Personal Information

On October 19, 2004, British Columbia passed Bill 73, which amends the Freedom of Information and Protection of Privacy Act (FOIPP Act) to restrict the disclosure of personal information outside Canada and expand the scope of personal liability and sanctions in the legislation. The move was in response to fears that the increased outsourcing of data processing and the management of information might subject personal information sent abroad to uses inconsistent with Canadian law. As reported in a previous issue of E-TIPSâ„¢ newsletter (Vol 2, No 26, June 9, 2004), a BC public service employees union filed a lawsuit against the provincial government's plan to retain a US-linked contractor to run the province's public health insurance program. In response, British Columbia's Information and Privacy Commissioner launched a public consultation into the ramifications of the USA Patriot Act (see the earlier issue of E-TIPSâ„¢ newsletter referred to above). Underlining the sensitivity of the issue, the Commissioner received over 500 submissions from citizens, governments and public interest groups, as well as from provincial, national and international data protection commissioners. On October 29, 2004, the Commissioner released a report which commended the provincial government for taking a leadership position in addressing some of the problems associated with outsourcing, but recommended increased clarification of certain areas of the FOIPP Act and his powers to oversee it. Bill 73 expands the scope of the FOIPP Act in three areas. First, the FOIPP Act will now apply not only to personal information in the custody and control of public bodies, but also to personal information in the custody and control of organizations that provide services to public bodies, even if these organizations are not public. Second, Bill 73 makes individuals liable and subject to fines: for failure to report foreign demands for disclosure of personal information in the custody or control of a public body or a related service provider; for an employer which discriminates against whistle-blowers who report contraventions or who refuse to contravene the Act; and for contravening the restrictions on storing, accessing or disclosing personal information outside Canada. A third change relates to the powers of the Commissioner, who will now have the authority to issue binding orders against service providers, both public and private. The Bill 73 amendments will not entirely alleviate the legal uncertainty around trans-border outsourcing. The blurring of the line between public sector privacy legislation and the private sector law will create overlapping jurisdiction and requirements which will make it difficult for many legitimate organizations to navigate their obligations. Moreover, Bill 73 fails to stipulate minimum conditions for trans-border information-sharing agreements and thus leaves open a backdoor for disclosures by domestic or to foreign law enforcement agencies under ambiguous arrangements. For a more extended commentary on the Bill 73 amendments, see the article entitled "BC Makes New Rules on International Outsourcing of Personal Information": http://dww.local/articles\bcpatriot_amendments.htm The text of Bill 73, as passed, can be seen at: http://www.legis.gov.bc.ca/37th5th/3rd_read/gov73-3.htm. For the text of the Information and Privacy Commissioner's Report, visit: http://makeashorterlink.com/?B22553DB9. For resources on the USA Patriot Act from the American Civil Liberties Union, see: http://www.aclu.org/SafeandFree/SafeandFree.cfm?ID=12126&c=207. Summary by: Jason Young