Sep 2019 Charity & NFP Law Update
On September 23, 2019, the Office of the Privacy Commissioner of Canada (“OPC”) announced that it had concluded its consultation on data transfers of personal information for processing (“Consultation”). As was discussed in the June 2019 Charity & NFP Law Update, the Consultation was originally launched on April 9, 2019 alongside the OPC’s Equifax Report of Findings, and was reframed on June 11, 2019. In the Equifax Report of Findings, the OPC had strayed from its longstanding position on transfers of personal information for processing, characterizing them as “disclosures” of personal information, rather than “use”, within the meaning of the Personal Information Protection and Electronic Documents Act (“PIPEDA”), and therefore requiring consent. However, the OPC has now concluded that its position under the current law, as outlined in the January 2009 Guidelines for processing personal data across borders, will remain unchanged and that consent will not be required in such instances.
In coming to this conclusion, the OPC took into consideration the 87 submissions it had received, including the Canadian Bar Association’s submission discussed in the August 2019 Charity & NFP Law Update. The vast majority of the submissions to the OPC took the view that there was no consent requirement under PIPEDA for transfers for processing and doing so would create enormous challenges for business processes. Further, the OPC relied on the Federal Court of Appeal’s decision in Englander v Telus Communications Inc. to illustrate that the “non-legal drafting” of PIPEDA makes it open to be interpreted in more than one way, and in such situations, “flexibility, common sense and pragmatism will best guide the Court.” As such, the OPC applied a pragmatic approach in maintaining the status quo until legislative reform occurs (for which it is currently in the process of developing recommendations) in order to modernize Canada’s federal private sector law.
In its announcement, the OPC further reminded organizations of the legal requirement of transparency in handling personal information and advising customers of the potential of their personal information being sent to another jurisdiction where it may be accessed by law enforcement, courts, or national security authorities. In addition, the OPC also shared its expectation that organizations will continue to apply the 2018 Guidelines for obtaining meaningful consent, and allow individuals to make informed decisions regarding the handling of their personal information by specifying certain key elements, including “what personal information is being collected; with which parties personal information is being shared; for what purposes personal information is collected, used or disclosed; and any residual meaningful risk of harm or other consequences.”
Charities and not-for-profits that are either subject to or choose to comply with PIPEDA and that may transfer personal information for processing would not be required under the current law, or under the OPC’s practices and policies, to obtain the consent of parties whose personal information is being used. However, these charities and not-for-profits should continue to ensure compliance with the privacy obligations imposed by PIPEDA as described in the previous paragraph.