The Office of the Privacy Commissioner of Canada (“OPC“) has backed away from attempting to reverse its position on cross border transfers of personal information, saying that at least for now, its guideline for processing data across borders remains unchanged.
The Reversal
The OPC created controversy in its Equifax Finding, wherein it declared that consent was necessary for transfers for processing, a wholesale departure from its previous position. The OPC simultaneously announced it would be holding a stakeholder consultation on transborder data flows. The consultation paper (“Consultation Paper”) proposed a reversal of the two-decades old existing policy on consent.
The existing Guidelines for Processing Personal Data Across Borders (“Guidelines”) were announced in 2009 and expressly state that (emphasis added):
A transfer for processing is a “use” of the information; it is not a disclosure. Assuming the information is being used for the purpose it was originally collected, additional consent for the transfer is not required.
The consultation document proposed the exact opposite (emphasis added):
In the absence of an applicable exception, the OPC’s view is that transfers for processing, including cross border transfers, require consent as they involve the disclosure of personal information from one organization to another.
The Repeat
However, the Consultation Paper simply stated the OPC’s position and invited the public’s views, with no indication of why the OPC thought the change was necessary or what the key issues were.
Shortly thereafter, the OPC then issued supplemental consultation paper (“Supplemental Consultation Paper”), in which the OPC provided its rationale for its about-face, and posed specific questions for stakeholders to consider. See our separate post providing an update on the Supplemental Consultation Paper here.
The Reframing
The OPC then made an announcement on June 11, 2019 relaunching its consultation, and characterized this new consultation as a “re-framing” of the prior, withdrawn one. Our commentary on the on again/off again process can be found here, here and here.
The OPC said it had decided to change its approach to consultation in light of the publication by the federal government of its Digital Charter on May 21, 2019 which suggested to the OPC that “transborder data flows may be dealt with in an eventual new federal privacy law.”
The Retreat
On September 23, 2019, the OPC announced that it had concluded its consultation transfers for processing and concluded that its 2009 Guidelines for Processing Personal Data Across Borders will remain unchanged under current law. The OPC commented that it had received 87 submissions and stated:
The vast majority took the view there was no requirement under the Personal Information Protection and Electronic Documents Act (PIPEDA) to seek consent for transfers for processing and that doing so would create enormous challenges for their business processes.
The OPC called its retreat a “pragmatic” move, in light of the submissions received.
However, the OPC was clear to note that the proposed modernization to PIPEDA, for which no timelines have been provided, may well result in the requirement of consent for transfers of personal information for processing.
