OPC pausing cross-border data consult after Digital Charter release

The Office of the Privacy Commissioner said this week it’s suspending its consultation on protections for personal information leaving the country because the government’s new digital charter initiative may address it in a future law. “In light of the government’s announcement and the feedback we are receiving from stakeholders, we need to consider the best way forward,” OPC spokeswoman Tobi Cohen said in an emailed statement on Thursday. That means the OPC will be updating its approach to the consultation and will confirm its new approach “as soon as possible,” Cohen said. Cohen said consideration needs to be given not just to the long term -- how a future law would address the transborder flow of Canadian data -- but also the short term in how the existing law addresses it. The OPC launched the consultation last month, and last week extended to late June the deadline period for comment. The consultation deals with a 2009 paper that touches on how the private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), applies to Canadians’ personal information when it leaves the country. For example, when a Canadian buys an airline ticket that requires an airport in another country to process the information, or when a Canadian’s data must reside in a data centre outside the country. Earlier this week, Innovation, Science, and Economic Development Canada (ISED) pledged to deal with those issues when it released a 10-principle “digital charter,” the result of a national data consultation it launched last June. ISED also released a supplementary document proposing to modernize PIPEDA, which suggests giving the OPC order-making power to be more authoritative in how it handles companies that don’t treat Canadian data according to law. “Complex data flows involving numerous parties, often across borders, can reduce an individuals’ sense of control over their personal information and ultimately their trust that it can be adequately protected,” the supplementary document said, adding that results in a “lack of clarity” about who is accountable for the data. The document proposes housing de-identified personal information into “data trusts” so that the information can be processed without consent. In that case, trusted independent third parties would manage access of data by organizations for the purposes of research and development. That would require revising the current consent exception for research in PIPEDA. It also proposes having standards, certification and codes of practice within PIPEDA for companies to proactively show they are complying with PIPEDA. However, it acknowledges that such an effort can be expensive and without proper oversight, it’s “at best meaningless and at worst deceptive.”

OPC pausing cross-border data consult after Digital Charter release

Brief | May 23, 2019

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

OPC pausing cross-border data consult after Digital Charter release

Brief | May 23, 2019

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Privacy commission, CRTC among best PS workplaces, survey finds

Dufresne pledges to continue Therrien’s work as Privacy Commissioner

Philippe Dufresne appointed Privacy Commissioner

New legislation needed to cover growing privacy issues: Therrien

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us