Digital Brain
digital brain
digital brain

OPC Maintains Status Quo on Transborder Data Flows…At Least for Now!

September 2019 Privacy Bulletin 2 minutes read

Upon receiving feedback from stakeholders regarding its consultation on transfers for processing and transborder data flows, the Office of the Privacy Commissioner of Canada (“OPC”) has decided to maintain the status quo.

As we reported, in April the OPC initiated a consultation on transborder dataflows under the Personal Information Protection and Electronic Documents Act (“PIPEDA”) (the “Consultation”). The OPC then released a reframed discussion document in June. The Consultation came 10 years after the OPC published its original “Guidelines for Processing Personal Data Across Borders” (the “2009 Guidelines”) and suggested a potentially significant shift from its earlier position on several key matters.

The key changes that would have been implemented if the OPC had moved ahead with the amended interpretation of PIPEDA described in the Consultation included:

  • making consent mandatory – meaning that any transfer of personal information for processing, including cross border transfers, would require consent (unless a specific PIPEDA exemption applies); and
  • requiring communication of alternative options – meaning that individuals would have to be informed of any options available to them if they do not wish to have their personal information disclosed outside Canada.

In response to the Consultation, the OPC reportedly received 87 submissions from stakeholders. Many of these submissions raised concerns, specifically, regarding the consent that would be required for transferring data for processing purposes.

Stakeholders opposed the views expressed in the Consultation on the basis that there was no requirement under PIPEDA to seek consent to transfer information for processing purposes and that doing so was unreasonably onerous. As a result, the OPC has concluded that its 2009 Guidelines will remain unchanged under PIPEDA, subject to future statutory changes. A copy of the 2009 guidelines can be found here.

Even though the OPC has decided to maintain the status quo, it has emphasized that organizations are still required to be transparent about personal information handling practices. This includes notifying customers if their personal information will be sent to another jurisdiction for processing. Such notice must also be communicated to individuals in accordance with the OPC’s guidelines for obtaining meaningful consent. You can view our prior bulletin on the meaningful consent guidelines here.

The OPC has also indicated that it will focus its efforts on how a reformed law can protect Canadian privacy rights, as it continues to hold the view that existing privacy protections for cross border data flows are “clearly insufficient”. It will be interesting to see how the government addresses this topic, which is a significant issue under many privacy laws across the world. As indicated in our prior bulletin “Proposed Digital Charter Could Bring Sweeping Changes to Canadian Privacy Laws”, the federal government has already called for submissions and input to inform ongoing discussions around its proposed amendments to PIPEDA. Of course, the outcome of the upcoming election may impact whether the Liberal Government is in a position to make any changes to the law following October 21, 2019.

by Lyndsay A. Wasser and Mitch Koczerginski

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2019

Related Publications (5 Posts)

Featured Insight

Addressing Unique Challenges Faced by Federally Regulated Employers

Federally regulated employers have had to adapt to a number of legal changes and challenges in recent years. In addition to continuing to respond to the COVID-19 pandemic, in 2021, federally regulated employers have had to implement workplace changes to adhere to the new Work Place Harassment and Violence Prevention Regulations and begin preparing to meet their obligations under recently adopted Pay Equity Act.
This virtual workshop will focus on how to address some of the unique challenges faced by federally regulated employers.

Tuesday, November 2, 2021
Featured Insight

Practical Considerations for Structuring Private REITs

Despite volatility, the market for Canadian REITs continues to rally creating opportunity for new players in a number of asset classes. This webinar focuses on the practical considerations for structuring private REITs.

Tuesday, November 9, 2021
Featured Insight

Bill 64 Enacted: Québec’s Modern Privacy Regime

An in-depth analysis of Quebec's 2021 modernization of its private-sector privacy legislation.

Read More
Oct 15, 2021
Featured Insight

China’s Arduous Path to CPTPP Accession – A Myriad of Obstacles with an Improbable Outcome

On September 16, 2021, China submitted its request to accede to the Comprehensive and Progressive Trans-Pacific Partnership (“CPTPP”).

Read More
Oct 13, 2021
Featured Insight

Privacy Implications of an Open Banking System in Canada

Canada’s Advisory Committee on Open Banking's final report- the privacy and data security implications of an open banking system in Canada.

Read More
Oct 12, 2021