Borders,
127 the OPC noted the obligation of organizations to be transparent with
their customers about their data handling practices. If data is to be transferred
offshore for processing, customers should be notified of this. The Guidelines also
state that customers should be warned that “while the information is in another
jurisdiction it may be accessed by the courts, law enforcement and national security
authorities”.
128
Concerns over the potential for foreign governments to access the personal
information of Canadians in the hands of offshore companies to which data has
been transferred for processing by Canadian companies were heightened by the
enactment of the USA Patriot Act
129 in 2001. To date, two provincial governments
in Canada have amended their public sector data protection laws to prohibit the
transfer or storage outside of Canada of Canadians’ personal information in the
hands of the public sector entities governed by those statutes.
130
References
Statutes and Regulations
Access to Information and Protection of Privacy Act, SNWT.1994, c 20
Access to Information and Protection of Privacy Act, SNWT 1994, c 20
Access to Information and Protection of Privacy Act, RSY 2002, c 1
An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain
activities that discourage reliance on electronic means of carrying out commercial activities, and
to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the
Telecommunications Act , S.C. 2010, c 23
An Act respecting access to documents held by public bodies and the Protection of personal
information, RSQ,c A-2.1
Act respecting the protection of personal information in the private sector, CQLR c P-39.1
An Act respecting the sharing of certain health information, SQ 2012, c 23
Bill C-59, An Act respecting national security matters, 41
st Parl., 1
st Sess
Breach of Security Safeguards Regulations, SOR/2018-64
Canadian Security Intelligence Service Act, RSC 1985, c C-23
Charter of Human Rights and Freedoms, CQLR c C-12
127 Privacy Commissioner of Canada, Guidelines for Processing Personal Data Across Borders,
January 2009, available at: https://www.priv.gc.ca/en/privacy-topics/personal-information-trans
ferred-across-borders/gl_dab_090127/.
128 Ibid.
129 Uniting (and) Strengthening America (by) Providing Appropriate Tools Required (to) Intercept
(and) Obstruct Terrorism Act of 2001, Pub L 107-56.
130 In British Columbia, s. 30.1 of the Freedom of Information and Protection of Privacy Act, RSBC
1996, c 165, prohibits transfers or storage outside of the country except in specified circumstances.
In Nova Scotia, the Personal Information International Disclosure Protection Act, SNS 2006, c
3, performs a similar function.
74
T. Scassa
127 the OPC noted the obligation of organizations to be transparent with
their customers about their data handling practices. If data is to be transferred
offshore for processing, customers should be notified of this. The Guidelines also
state that customers should be warned that “while the information is in another
jurisdiction it may be accessed by the courts, law enforcement and national security
authorities”.
128
Concerns over the potential for foreign governments to access the personal
information of Canadians in the hands of offshore companies to which data has
been transferred for processing by Canadian companies were heightened by the
enactment of the USA Patriot Act
129 in 2001. To date, two provincial governments
in Canada have amended their public sector data protection laws to prohibit the
transfer or storage outside of Canada of Canadians’ personal information in the
hands of the public sector entities governed by those statutes.
130
References
Statutes and Regulations
Access to Information and Protection of Privacy Act, SNWT.1994, c 20
Access to Information and Protection of Privacy Act, SNWT 1994, c 20
Access to Information and Protection of Privacy Act, RSY 2002, c 1
An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain
activities that discourage reliance on electronic means of carrying out commercial activities, and
to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the
Telecommunications Act , S.C. 2010, c 23
An Act respecting access to documents held by public bodies and the Protection of personal
information, RSQ,c A-2.1
Act respecting the protection of personal information in the private sector, CQLR c P-39.1
An Act respecting the sharing of certain health information, SQ 2012, c 23
Bill C-59, An Act respecting national security matters, 41
st Parl., 1
st Sess
Breach of Security Safeguards Regulations, SOR/2018-64
Canadian Security Intelligence Service Act, RSC 1985, c C-23
Charter of Human Rights and Freedoms, CQLR c C-12
127 Privacy Commissioner of Canada, Guidelines for Processing Personal Data Across Borders,
January 2009, available at: https://www.priv.gc.ca/en/privacy-topics/personal-information-trans
ferred-across-borders/gl_dab_090127/.
128 Ibid.
129 Uniting (and) Strengthening America (by) Providing Appropriate Tools Required (to) Intercept
(and) Obstruct Terrorism Act of 2001, Pub L 107-56.
130 In British Columbia, s. 30.1 of the Freedom of Information and Protection of Privacy Act, RSBC
1996, c 165, prohibits transfers or storage outside of the country except in specified circumstances.
In Nova Scotia, the Personal Information International Disclosure Protection Act, SNS 2006, c
3, performs a similar function.
74
T. Scassa