“Gonna stand my ground; And I won’t back down”¹ – The OPC charges forward with its controversial consultation on transborder dataflows/transfers for processing

“Gonna stand my ground; And I won’t back down”¹ – The OPC charges forward with its controversial consultation on transborder dataflows/transfers for processing

On June 11, 2019, the Office of the Privacy Commissioner of Canada (“OPC”) published a reframed discussion document (the “Reframed Discussion”) related to its controversial consultation on transborder dataflows (the “Consultation”), originally published on April 9, 2019. The Reframed Discussion comes after Privacy Commissioner of Canada Daniel Therrien’s May 23, 2019 announcement at the IAPP Canada Privacy Symposium of the OPC’s intention to suspend the Consultation.

Background

The OPC initially launched the Consultation in connection with its recent investigation into the Equifax data breach. Notably, the Report of Findings on the Equifax case included a finding that consent was required under the Personal Information Protection and Electronic Documents Act (“PIPEDA”) for the transfer of personal information from Equifax Canada to its US affiliate, Equifax Inc., for processing. This finding represented a significant shift in the OPC’s previous policy position, wherein it has repeatedly expressed the view that transfers for processing are a “use”, not a “disclosure” of personal information, and therefore, consent is not required. The Consultation expresses the opposite view, and suggests that consent is needed for transborder dataflows, including to service providers, and in fact for all transfers of personal information for processing.

Clearly anticipating a reaction to the Equifax decision, the OPC laid out its new position in the Consultation, and invited stakeholders to share their comments and concerns. The reaction from businesses in a wide variety of industries was vehement. One of the most widespread concerns stemmed from the practical implications of requiring consent for each and every transfer of personal information to a service provider or affiliate, which would create a logistical nightmare for organizations. Midway through the Consultation, the OPC released a “supplementary discussion document” and extended the deadline for feedback.

The OPC then suspended the Consultation, citing potential statutory changes arising out of the Digital Charter announced by the Federal Government on May 21, 2019, and the accompanying white paper entitled Strengthening Privacy for the Digital Age, which included considerations for amending PIPEDA. See McMillan’s summary of the Digital Charter.

Although the Reframed Discussion appears to soften some of the language from the initial Consultation, it also broadens the scope. Notably, the Reframed Discussion no longer focuses on transborder data flows, but rather, has been reissued as a “Consultation on transfers for processing”, in an apparent recognition of the fact that the issues raised in the Consultation are equally applicable to domestic data processing arrangements.

The Reframed Discussion was also expanded to seek feedback on the future of Canadian privacy law, as discussed further below.

Comments on how to effectively protect privacy in the longer term (PIPEDA amendments)

In the Reframed Discussion, the OPC noted that legislative changes to PIPEDA could render any guidelines or interpretation of the current PIPEDA provisions respecting transfers for processing moot, depending on the final changes that are ultimately implemented (if any).

Additionally, the OPC included the following comments and recommendations with respect to upcoming legislative changes:

• Amendments should require demonstrable accountability, including authority for the OPC to proactively inspect the practices of organizations to ensure that they truly are accountable.
• Standard contractual clauses may be appropriate for transborder dataflows. Although the Reframed Discussion considered the adoption of an adequacy regime (whereby the personal information of Canadians may only be transferred outside the country if the receiving country has laws that provide an adequate level of protection), the OPC commented that this change may be too fundamental, and also noted that the efficacy of such a regime is not universally recognized.
• Consent may be required for data transfers when neither contractual clauses nor other means provide effective protection. The OPC stated that, to be clear, it would not recommend that consent be required in the longer term in the context of data transfers for processing, if other effective means are found to protect the privacy rights of individuals.
  The OPC has invited comments from stakeholders on the position that the OPC should take when it provides its submissions to the Federal Government on the potential upcoming amendments to PIPEDA, including providing several questions about the future law that stakeholders may wish address.

Comments on transfers for processing under the current law

The OPC acknowledged that, through the Equifax decision, it had applied a different interpretation of PIPEDA than it had in the past. In the OPC’s view, its new interpretation was more consistent with the plain wording of PIPEDA. In particular, the OPC emphasized that its previous position that a “transfer” is not a “disclosure” is debatable at best, and in all likelihood, incorrect. In response to feedback challenging its new interpretation, the OPC suggested that if Parliament intended for processing situations to be exempt from consent, it could have included a specific exception to that effect (similarly to some of the provincial statutes).

In any event, the OPC indicated that transparency with respect to transborder transfers has always been required. Accordingly, the OPC suggested that its change in policy position may not require organizations subject to and compliant with PIPEDA to fundamentally change their practices. However, many businesses would likely disagree that a shift from transparency to consent is not a significant change.

The OPC is still soliciting feedback from stakeholders on its interpretation of the current PIPEDA terms, and has restated in the Reframed Discussion the questions that were included in the supplementary discussion document issued in connection with the initial Consultation.

Ensure your voice is heard

The OPC will be accepting submissions on both the future of PIPEDA and its interpretation of the current law until August 6, 2019. Comments can be submitted to OPC-CPVPconsult2@priv.gc.ca.

by Lyndsay A. Wasser and Grace Shaw

[1] Tom Petty and the Heartbreakers, “I Won’t Back Down”.

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2019