On June 11, 2019, the Office of the Privacy Commission (“OPC”) announced that it is reframing its consultation on transfers of personal information (“PI”) for processing, including transborder data flows.
The Original Announcement
We discussed the original announcement of the OPC’s consultation in our previous bulletin: Privacy Commissioner of Canada Reverses Position on Transfers of Personal Information for Processing, Initiates Consultation on Cross-border Transfers.
As noted in our previous bulletin, the OPC had made a surprising reversal of its long-standing position on the transfer of PI under the Personal Information Protection and Electronic Documents Act ("PIPEDA") (PDF). In the past, the OPC viewed a transfer of PI for processing as a “use” of the PI by the transferor rather than a “disclosure” to the processor, such that an additional consent was not required, as long as the PI was being processed for the purpose for which it was originally collected.
The OPC now states that it views the transfer of PI for processing as a disclosure requiring consent. The new OPC position applies to any transfer of PI from one organization to another, including transfers within Canada, cross-border transfers, and transfers to service providers and affiliates. In its consultation, the OPC solicited submissions on its new position.
In our previous bulletin we discussed the previous OPC position, the new OPC position, the original scope of the OPC’s consultation, and whether consent to a disclosure for processing must be express consent. We also offered some suggestions on what organizations might wish to do at this stage in the process, and made some additional general comments about the potential impact of the change in the OPC’s position.
The Reframed Consultation
Verbal comments made by the OPC at recent privacy conferences led many to believe that the consultation would be suspended. However, it continues and has been expanded.
The OPC has reframed the consultation in response to the release of Canada's Digital Charter, and the possibility that amendments to federal privacy laws will address transborder data flows. In the reframed consultation document the OPC retains its original questions and also asks additional questions related to how a future privacy law could address transborder data flows.
Despite widespread opposition, the OPC essentially doubles down on its new position, elaborating on its earlier arguments that the transfer of PI for processing is a disclosure requiring consent.
Key PIPEDA Concerns
In its discussion of possible future PIPEDA amendments, the OPC advocates for (1) the right to proactively inspect the privacy practices of organizations to ensure that they are accountable (rather than waiting to respond to complaints), (2) the adoption of a GDPR adequacy regime for transborder data flows (or, failing the adoption of an adequacy regime, the required use of OPC approved standard contractual clauses), and (3) meaningful consent for at least some cross-border transfers of PI.
Extension of Time for Submissions
The deadline for submissions to the consultation has been extended to August 6, 2019.
Organizations may wish to submit a response to the OPC consultation, to monitor the OPC consultation process, and to review future changes to the OPC guidance documents on transfers of PI for processing, including transborder data flows.
In the reframed consultation, the OPC states that it does not expect organizations to change their practices until the conclusion of the consultation. However, organizations should be cautious in fully relying on this statement. It remains possible that the OPC may apply its new position in any investigation prior to the conclusion of the consultation, particularly if there are circumstances that the OPC views as egregious.
We will continue to monitor developments related to the OPC’s consultation.