authority to levy fines and for such fines to be adapted to the size and revenues of
transgressing organizations.
7 Private International Law Rules
In Lawson v. Accusearch Inc.,
123 the Federal Court of Canada ruled that PIPEDA
applied to the collection, use and disclosure of the personal information of Canadians
by a U.S.-based company. The Court found that “PIPEDA gives the Privacy
Commissioner jurisdiction to investigate complaints relating to the transborder
flow of personal information”.
124 This jurisdiction exists so long as there is a
sufficient connection to Canada. Since then, the Commissioner has investigated
numerous complaints relating to offshore companies, including social media platforms. In deciding on whether to investigate a foreign company, the Commissioner
will take into account factors such as the : “location in which the activity takes place;
location to which profits flow; location of preparatory activities; residency of parties
involved; location of contract; location of any potential related proceedings; jurisdiction where promotional efforts primarily targeted; location of content provider;
location of host server; location of intermediaries; location of the end user”.
125
Although the Commissioner may investigate complaints into the activities of
offshore companies, he does not have the power to compel companies outside
Canada to disclose records or to submit to on-site investigations. In many cases,
the Commissioner has relied upon the voluntary co-operation of such companies. In
a few instances, the Commissioner has also worked with the data protection authorities in the country where the organization is located. The Commissioner has no
extraterritorial enforcement powers. However, in some instances, offshore companies have responded positively to the Commissioner’s recommendations. It is also
possible to seek an order from the Federal Court, as was done in A.T. v. Globe24hr.
com.
126 Where such an order issues, its enforcement must be sought in the foreign
jurisdiction or it will largely be without effect.
PIPEDA permits organizations to transfer personal information to an organization
in another country for processing, but holds these organizations accountable.
According to Clause 4.1.3 of Schedule I of PIPEDA, an organization must provide
a level of protection to the information that is comparable to what it offers under its
own privacy policies. This is principally done through contractual arrangements with
the offshore processor. In its 2009 Guidelines for Processing Personal Data Across
123 Lawson v. Accusearch Inc., [2007] 4 FCR 314, 2007 FC 125.
124 Ibid. at para 51.
125 Ibid. at para 42.
126 See, e.g. PIPEDA Report of Findings #2018-002, at para 12.
Data Protection and the Internet: Canada
73
transgressing organizations.
7 Private International Law Rules
In Lawson v. Accusearch Inc.,
123 the Federal Court of Canada ruled that PIPEDA
applied to the collection, use and disclosure of the personal information of Canadians
by a U.S.-based company. The Court found that “PIPEDA gives the Privacy
Commissioner jurisdiction to investigate complaints relating to the transborder
flow of personal information”.
124 This jurisdiction exists so long as there is a
sufficient connection to Canada. Since then, the Commissioner has investigated
numerous complaints relating to offshore companies, including social media platforms. In deciding on whether to investigate a foreign company, the Commissioner
will take into account factors such as the : “location in which the activity takes place;
location to which profits flow; location of preparatory activities; residency of parties
involved; location of contract; location of any potential related proceedings; jurisdiction where promotional efforts primarily targeted; location of content provider;
location of host server; location of intermediaries; location of the end user”.
125
Although the Commissioner may investigate complaints into the activities of
offshore companies, he does not have the power to compel companies outside
Canada to disclose records or to submit to on-site investigations. In many cases,
the Commissioner has relied upon the voluntary co-operation of such companies. In
a few instances, the Commissioner has also worked with the data protection authorities in the country where the organization is located. The Commissioner has no
extraterritorial enforcement powers. However, in some instances, offshore companies have responded positively to the Commissioner’s recommendations. It is also
possible to seek an order from the Federal Court, as was done in A.T. v. Globe24hr.
com.
126 Where such an order issues, its enforcement must be sought in the foreign
jurisdiction or it will largely be without effect.
PIPEDA permits organizations to transfer personal information to an organization
in another country for processing, but holds these organizations accountable.
According to Clause 4.1.3 of Schedule I of PIPEDA, an organization must provide
a level of protection to the information that is comparable to what it offers under its
own privacy policies. This is principally done through contractual arrangements with
the offshore processor. In its 2009 Guidelines for Processing Personal Data Across
123 Lawson v. Accusearch Inc., [2007] 4 FCR 314, 2007 FC 125.
124 Ibid. at para 51.
125 Ibid. at para 42.
126 See, e.g. PIPEDA Report of Findings #2018-002, at para 12.
Data Protection and the Internet: Canada
73