In an Announcement this week, the Office of the
Privacy Commissioner of Canada (OPC) has put “on hold”
any changes in approach for cross-border data flows of personal
information, stating “its guidelines for processing personal data across
borders will remain unchanged under the current law.”
What this means is the OPC does not interpret the Personal
Information Protection and Electronic Documents Act
(PIPEDA) as requiring consent for cross-border data flows,
including the processing of personal information outside of Canada.
As widely reported in the spring, the OPC
indicated its view is that cross-border transfers of personal
information require consent.
The OPC will continue to, and we anticipate will be more
vigilant about, ensuring organizations provide transparency about
transborder data flows, and take steps to ensure personal
information is adequately protected in the hands of processors. Key
considerations for organizations are:
