OPC Concludes Consultation on Transborder Data Flows

On September 23, 2019, the Office of the Privacy Commissioner of Canada (OPC) announced that it has concluded its consultation on transborder data flows and that its guidelines for processing personal data across borders will remain unchanged.

In April 2019, the OPC proposed a new policy requiring that organizations obtain consent when transferring personal information to service providers for data processing.  The OPC subsequently launched, revisited and reframed its consultation on the proposed policy, as previously reported by the E-TIPS® Newsletter here, here and here.  

The OPC has elected not to adopt its proposed policy.  The OPC’s announcement states that “it will maintain the status quo until the law is changed.”  The announcement also states that the majority of the submissions it received as part of the consultation process took the view that there was no requirement under the Personal Information Protection and Electronic Documents Act (PIPEDA) to seek consent for transfers for processing and that doing so would create major challenges for organizations.

While the OPC elected not to change its guidelines on transborder data flows, the OPC reminded organizations that they remain legally required to be transparent about their personal information handling practices.  Therefore, while consent may not be required, organizations must be transparent about their personal information handling practices. This includes advising customers that their personal information may be sent to another jurisdiction for processing and that while the information is in another jurisdiction it may be accessed by the courts, law enforcement and national security authorities.

Summary By: Michelle Noonan