Federal Privacy Commissioner Confirms Express Consent Not Required For Cross-Border Data Transfers

The Office of the Privacy Commissioner of Canada ("OPC") has now decided¹ that the Personal Information Protection and Electronic Documents Act ("PIPEDA") does not require organizations to obtain separate express consent for the transfer of personal information to service providers located outside of Canada.

The recent decision makes it clear, however, that organizations who use third party service providers outside of Canada must: (1) provide individuals with appropriate notice of cross border data transfers; and (2) be accountable for that personal information by ensuring that it remains adequately protected from unauthorized access, use and/or disclosure in the hands of that third party service provider. The OPC described how organizations can fulfill these requirements, which we discuss below.