OFFICE OF THE PRIVACY COMMISSIONER OF CANADA RESTORES 2009 POLICY POSITION ON DATA TRANSFERS FOR PROCESSING
The Office of the Privacy Commissioner of Canada (OPC) announced on September 23, 2019 that its proposals requiring client consent for transferring data to third parties (domestically or internationally) for processing purposes will not take effect, and that its guidelines for such transfers will remain unchanged under the current law. The decision reflects arguments set forth in the IIAC submission and submissions by other industry groups.
In its submission, the IIAC indicated that the proposal will impose a significant burden on both firms and their clients without affording additional investor protection. In addition, the enhanced consent requirement would detract from PIPEDA’s stated goal “to support and promote electronic commerce” in that the costly and unwieldy regulatory burden stemming from its implementation will discourage innovations that promote better client services.
The OPC stated that it will follow the guidance of the Federal Court of Appeal in interpreting the legislation, such that flexibility, common sense and pragmatism should apply. The OPC is applying this pragmatic approach in determining that it will maintain the status quo until the law is changed, which may be years in the future.
As it develops recommendations for modernizing Canada’s federal private sector law, the OPC will take into consideration the submissions it has received that speak to legislative reform and how a future law could address transfers for processing and transborder data flows to effectively protect privacy.