What The OPC's Decision In Equifax Means For Cross-Border Data Transfers And Outsourcing

The Office of the Privacy Commissioner of Canada (OPC) released its report on its investigation into a 2017 data breach at Equifax and reversed its position on the privacy requirements that attach to intercompany data transfers and cross-border data transfers. The decision will have long-term impacts for Canadian companies' domestic and cross-border data practices.

What you need to know

• The OPC now considers transfers of personal information from a company to an affiliate or third-party vendor for processing purposes as disclosures of personal information to third parties.
• Companies must obtain meaningful consent to disclose personal information to third parties. This includes clearly explaining the nature and purpose of the transfer, whether the recipient processor is located outside Canada, and any alternatives that would allow the customer to continue receiving services without transferring data internationally.