Jun 2019 Charity & NFP Law Update
On June 11, 2019, the Office of the Privacy Commissioner of Canada (“OPC”) announced that it is reframing its “Consultation on transborder data flows.” Originally launched on April 9, 2019 following the release of the OPC’s Equifax Report of Findings, as discussed in Charity and NFP Law Bulletin No. 445, the consultation was later suspended following the release of the Digital Charter by the Government of Canada on May 21, 2019, as discussed in Charity and NFP Law Bulletin No. 449. The OPC has now given the consultation a new name – it is now entitled the “Consultation on transfers for processing” – and a new scope. Although the reframed consultation continues to invite stakeholders to share their views on how to interpret and apply the current law, as originally framed, the OPC has, in response to the Digital Charter, expanded the scope of the consultation to include a series of new questions on how a future privacy law could effectively protect privacy in the context of transborder data flows. The new deadline for submissions is August 6, 2019.
In its reframed discussion document (the “OPC Paper”), the OPC again recognizes that its interpretation of the existing legislation in the Equifax Report of Findings was a departure from its previous guidances. In this regard, it had characterized the cross-border transfer of personal information for processing as a “disclosure” of personal information within the meaning of the Personal Information Protection and Electronic Documents Act (“PIPEDA”) requiring consent, rather than a “use”, which does not require consent. Acknowledging that this is a period of “some uncertainty”, the OPC Paper confirms that, at least until the conclusion of the consultation, the OPC does not expect organizations to change their practices.
The OPC Paper further identifies the Digital Charter, and its accompanying white paper, which discusses areas of potential amendment to PIPEDA, as having introduced a new “factor of uncertainty.” In this regard, the OPC Paper advises that the OPC intends to make recommendations to the Federal Government regarding amendments that should be made to PIPEDA and has therefore expanded this consultation in order to obtain stakeholder views on what recommendations would be desirable. It is not clear from the OPC Paper why stakeholders could not make such recommendations directly to the Federal Government rather than to the OPC, which is not responsible for PIPEDA or for making legislative amendments to PIPEDA. Pointing out that legislative change could take years, the OPC Paper states that it is necessary for the OPC to continue to receive submissions on how it should apply the current law, suggesting that it may publish amended guidelines concerning transborder data flows, even if they are destined to be short-lived.
Stating that the OPC’s long-term goal is to ensure effective privacy protection in the context of transborder data flows and transfers for processing, the OPC Paper points out that the PIPEDA principle of accountability “is not always effective in protecting privacy”, as demonstrated in Equifax, and suggests that PIPEDA be amended to empower the OPC to proactively inspect the practices of organizations to ensure that they truly are accountable. The OPC paper also suggests that Canada should seriously consider adopting a regime of standard contractual clauses approved by an “independent public authority” (which it suggests to be the “domestic regulator”, presumably the OPC), to add an additional level of review.
The OPC Paper also expresses the OPC’s concern with respect to the risk that information about activities that are legal in Canada, but which do not enjoy equal protection outside Canada, such as the purchase and use of cannabis, or donations to religious or political causes, could be used against individuals outside of Canada. Stating that the Government of Canada must protect its citizens in these circumstances, the OPC Paper suggests that one option might be to require meaningful consent when a transfer of personal information entails such risks. In an apparent softening of its position as stated in Equifax, the OPC Paper states that the OPC would not recommend that consent be required in the longer term for data transfers for processing if other effective means are found to protect the privacy rights of individuals.
Advising that it did not reach its conclusion in the Equifax decision lightly, but that it felt that its new interpretation was more consistent with PIPEDA, the OPC Paper states that the OPC now wishes to hear from all stakeholders in order to decide whether to apply the Equifax interpretation to all organizations. It is clear from the OPC Paper, however, that the OPC is still of the view that, as stated in Equifax, that transfers for processing are “disclosures” rather than “uses.” The OPC Paper goes on to ask its new questions about how a future law should effectively protect privacy in the context of transborder data flows and transfers for processing, followed by the original consultation questions about how the current law should be applied.
The OPC’s position on transborder data transfers and transfers for processing could have significant implications for charities and not-for-profits that are subject to PIPEDA or that choose to comply with PIPEDA. In this period of uncertainty, charities and not-for-profits should closely monitor the progress of this consultation process and may even wish to make a submission. Since it appears the OPC and the Federal Government still have some work to do in terms of coordinating their efforts, charities and not-for-profits should also stay alert to guidelines and changes to current legislation coming from the Federal Government in the context of the Digital Charter.