You Are The Company You Keep: Managing Third Party Privacy Risk

Privacy regulators across Canada are signalling an increased focus on a particular risk area: namely, reliance on service providers. In the past few weeks, we have seen a few key developments:

• The  Announcement of a joint investigation by the Privacy Commissioner of Canada, and the Privacy Commissioner for British Columbia, into a company relied on by landlords for background screening of potential tenants.
• The release of a new guidance document, Privacy and Access in Public Sector Contracting with Third Party Service Providers, by the Information and Privacy Commissioner of Ontario (see the bulletin drafted by Jennifer Hunter,  Privacy and Access Considerations When Contracting With Third Parties: The IPC Provides New Guidance to Public Entities) for organizations subject to Ontario's Freedom of Information and Protection of Privacy Act (FIPPA). The guidance builds on the positions articulated in the  IPC's Privacy Complaint Report¹ from February 2024