{"id":3560,"date":"2009-02-06T07:30:20","date_gmt":"2009-02-06T12:30:20","guid":{"rendered":"http:\/\/www.iposgoode.ca\/?p=3115"},"modified":"2009-02-06T07:30:20","modified_gmt":"2009-02-06T12:30:20","slug":"guidelines-for-processing-personal-data-across-borders","status":"publish","type":"post","link":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2009\/02\/06\/guidelines-for-processing-personal-data-across-borders\/","title":{"rendered":"Guidelines for processing personal data across borders: liability for transferring organizations"},"content":{"rendered":"

In response to the growing concerns of illicit use of personal information and corresponding adverse consequences such as identity theft, financial disclosures and private health information revelation, the Office of Privacy Commissioner of Canada (OPC) released a document entitled \u201cGuidelines for Processing Personal Data Across Borders<\/a>\u201d on January 27, 2009. This document provides guidelines explaining how the <\/span>Personal Information Protection and Electronic Documents Act<\/span><\/em> (PIPEDA) applies to transfers of personal information to a third party, including a third party operating outside of Canada, for processing. As a reminder<\/a>, there are two federal privacy laws in Canada - the Privacy Act and PIPEDA. Both are aimed at regulating the collection, use and disclosure of personal information. However, the Privacy Act is directed at federal departments and agencies, and is authority-based, requiring the existence of legal authority to collect, use or disclose information. PIPEDA, on the other hand, is aimed at Canadian private sector organizations and is consent-based, requiring the consent to collect, use or disclose information. <\/span><\/p>\n

<\/span>T<\/span>he pith and substance of PIPEDA can be best characterized as <\/span>\u201cAn Act to support and promote electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances\u201d<\/span><\/a>. Principle 1 of the PIPEDA states:<\/span><\/span><\/span><\/p>\n

\n

\"An organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.\"<\/a><\/span><\/em><\/span><\/span><\/p>\n<\/blockquote>\n

For clarification<\/a> purposes, the guidelines clarify the meanings of the terms: \u201ctransfer\u201d, \u201cprocessing\u201d and \u201ccomparative level of protection\u201d. \u201cTransfer\u201d, unlike disclosure, is intended to make the document available only for the use for which the information was collected. Similarly, \u201cprocessing\u201d is interpreted as the use of the document for the purpose for which the transferring organization can use it. Lastly, \u201ccomparable level of protection\u201d means that the third party processor must provide protection that can be compared to the level of protection the personal information would receive if it had not been transferred.<\/span><\/span><\/p>\n

There are different approaches to protecting personal information that is being transferred for processing. European Union member states have passed laws prohibiting the transfer of personal information to another jurisdiction unless the European Commission has determined that the other jurisdiction offers \"adequate\" protection for personal information. In contrast, Canada does not provide for any authoritative body to make the final call on whether an organization is well-equipped to provide a comparable protection. Instead, OPC recommends that organizations should pre-contract and take all reasonable steps before exchanging the personal information. There is also an underlying emphasis on the consideration that should be given to the third party jurisdictions\u2019 legal requirements, and the \u201cpotential foreign political, economic and social conditions\u201d<\/a> that may reduce their ability to provide the service.\u00a0 <\/span><\/span><\/p>\n

The Canadian approach rightly holds that the final decision on whether to transfer personal information lies with the host organization itself. With the increase in the outsourcing of processes to third parties, it is only fair that the organizations undergoing potential cost savings and making profits also bear the burden associated with personal information misuse. The guidelines also emphasize the need of transparency towards the customers, such as their access to the organization\u2019s personal information handling practices. Such a possibility creates a strong incentive for these organizations to be extra careful and to make a conscious and well-informed decision about the transferring of personal information. Overall, Principle 1 of PIPEDA provides for a balancing provision between the protection of personal information of individuals and the business necessity of transferring information. Therefore, it appears that the current approach adopted by Canada is an efficient <\/span>way to achieve a safe and favourable personal data transfer.\u00a0<\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

In response to the growing concerns of illicit use of personal information and corresponding adverse consequences such as identity theft, financial disclosures and private health information revelation, the Office of Privacy Commissioner of Canada (OPC) released a document entitled \u201cGuidelines for Processing Personal Data Across Borders\u201d on January 27, 2009. This document provides guidelines explaining […]<\/p>\n","protected":false},"author":2140,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","footnotes":""},"categories":[397,225,247,110],"tags":[422,424,298,292],"class_list":["post-3560","post","type-post","status-publish","format-standard","hentry","category-contracts","category-human-rights-issues","category-identity-theft","category-privacy","tag-contracts","tag-identity-theft","tag-privacy","tag-reshika-dhir-ipilogue-editor"],"yoast_head":"\nGuidelines for processing personal data across borders: liability for transferring organizations - IPOsgoode<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2009\/02\/06\/guidelines-for-processing-personal-data-across-borders\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Guidelines for processing personal data across borders: liability for transferring organizations - IPOsgoode\" \/>\n<meta property=\"og:description\" content=\"In response to the growing concerns of illicit use of personal information and corresponding adverse consequences such as identity theft, financial disclosures and private health information revelation, the Office of Privacy Commissioner of Canada (OPC) released a document entitled \u201cGuidelines for Processing Personal Data Across Borders\u201d on January 27, 2009. This document provides guidelines explaining […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2009\/02\/06\/guidelines-for-processing-personal-data-across-borders\/\" \/>\n<meta property=\"og:site_name\" content=\"IPOsgoode\" \/>\n<meta property=\"article:published_time\" content=\"2009-02-06T12:30:20+00:00\" \/>\n<meta name=\"author\" content=\"ccraig\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ccraig\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2009\\\/02\\\/06\\\/guidelines-for-processing-personal-data-across-borders\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2009\\\/02\\\/06\\\/guidelines-for-processing-personal-data-across-borders\\\/\"},\"author\":{\"name\":\"ccraig\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/#\\\/schema\\\/person\\\/09b0ef7189d5a2bd6fef2472e5ea5b94\"},\"headline\":\"Guidelines for processing personal data across borders: liability for transferring organizations\",\"datePublished\":\"2009-02-06T12:30:20+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2009\\\/02\\\/06\\\/guidelines-for-processing-personal-data-across-borders\\\/\"},\"wordCount\":634,\"keywords\":[\"Contracts\",\"Identity Theft\",\"privacy\",\"Reshika Dhir (IPilogue Editor)\"],\"articleSection\":[\"Contracts\",\"Human Rights Issues\",\"Identity Theft\",\"Privacy\"],\"inLanguage\":\"en-CA\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2009\\\/02\\\/06\\\/guidelines-for-processing-personal-data-across-borders\\\/\",\"url\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2009\\\/02\\\/06\\\/guidelines-for-processing-personal-data-across-borders\\\/\",\"name\":\"Guidelines for processing personal data across borders: liability for transferring organizations - IPOsgoode\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/#website\"},\"datePublished\":\"2009-02-06T12:30:20+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/#\\\/schema\\\/person\\\/09b0ef7189d5a2bd6fef2472e5ea5b94\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2009\\\/02\\\/06\\\/guidelines-for-processing-personal-data-across-borders\\\/#breadcrumb\"},\"inLanguage\":\"en-CA\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2009\\\/02\\\/06\\\/guidelines-for-processing-personal-data-across-borders\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/2009\\\/02\\\/06\\\/guidelines-for-processing-personal-data-across-borders\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Guidelines for processing personal data across borders: liability for transferring organizations\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/#website\",\"url\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/\",\"name\":\"IPOsgoode\",\"description\":\"An Authoritive Leader in IP\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-CA\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/#\\\/schema\\\/person\\\/09b0ef7189d5a2bd6fef2472e5ea5b94\",\"name\":\"ccraig\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-CA\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4d6461ef50f637a66f0e694df440ca5896971e12de84d604936521b184fec22a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4d6461ef50f637a66f0e694df440ca5896971e12de84d604936521b184fec22a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4d6461ef50f637a66f0e694df440ca5896971e12de84d604936521b184fec22a?s=96&d=mm&r=g\",\"caption\":\"ccraig\"},\"url\":\"https:\\\/\\\/www.yorku.ca\\\/osgoode\\\/iposgoode\\\/author\\\/ccraig\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Guidelines for processing personal data across borders: liability for transferring organizations - IPOsgoode","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2009\/02\/06\/guidelines-for-processing-personal-data-across-borders\/","og_locale":"en_US","og_type":"article","og_title":"Guidelines for processing personal data across borders: liability for transferring organizations - IPOsgoode","og_description":"In response to the growing concerns of illicit use of personal information and corresponding adverse consequences such as identity theft, financial disclosures and private health information revelation, the Office of Privacy Commissioner of Canada (OPC) released a document entitled \u201cGuidelines for Processing Personal Data Across Borders\u201d on January 27, 2009. This document provides guidelines explaining […]","og_url":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2009\/02\/06\/guidelines-for-processing-personal-data-across-borders\/","og_site_name":"IPOsgoode","article_published_time":"2009-02-06T12:30:20+00:00","author":"ccraig","twitter_card":"summary_large_image","twitter_misc":{"Written by":"ccraig","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2009\/02\/06\/guidelines-for-processing-personal-data-across-borders\/#article","isPartOf":{"@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2009\/02\/06\/guidelines-for-processing-personal-data-across-borders\/"},"author":{"name":"ccraig","@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/#\/schema\/person\/09b0ef7189d5a2bd6fef2472e5ea5b94"},"headline":"Guidelines for processing personal data across borders: liability for transferring organizations","datePublished":"2009-02-06T12:30:20+00:00","mainEntityOfPage":{"@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2009\/02\/06\/guidelines-for-processing-personal-data-across-borders\/"},"wordCount":634,"keywords":["Contracts","Identity Theft","privacy","Reshika Dhir (IPilogue Editor)"],"articleSection":["Contracts","Human Rights Issues","Identity Theft","Privacy"],"inLanguage":"en-CA"},{"@type":"WebPage","@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2009\/02\/06\/guidelines-for-processing-personal-data-across-borders\/","url":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2009\/02\/06\/guidelines-for-processing-personal-data-across-borders\/","name":"Guidelines for processing personal data across borders: liability for transferring organizations - IPOsgoode","isPartOf":{"@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/#website"},"datePublished":"2009-02-06T12:30:20+00:00","author":{"@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/#\/schema\/person\/09b0ef7189d5a2bd6fef2472e5ea5b94"},"breadcrumb":{"@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2009\/02\/06\/guidelines-for-processing-personal-data-across-borders\/#breadcrumb"},"inLanguage":"en-CA","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2009\/02\/06\/guidelines-for-processing-personal-data-across-borders\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/2009\/02\/06\/guidelines-for-processing-personal-data-across-borders\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/"},{"@type":"ListItem","position":2,"name":"Guidelines for processing personal data across borders: liability for transferring organizations"}]},{"@type":"WebSite","@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/#website","url":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/","name":"IPOsgoode","description":"An Authoritive Leader in IP","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-CA"},{"@type":"Person","@id":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/#\/schema\/person\/09b0ef7189d5a2bd6fef2472e5ea5b94","name":"ccraig","image":{"@type":"ImageObject","inLanguage":"en-CA","@id":"https:\/\/secure.gravatar.com\/avatar\/4d6461ef50f637a66f0e694df440ca5896971e12de84d604936521b184fec22a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4d6461ef50f637a66f0e694df440ca5896971e12de84d604936521b184fec22a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d6461ef50f637a66f0e694df440ca5896971e12de84d604936521b184fec22a?s=96&d=mm&r=g","caption":"ccraig"},"url":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/author\/ccraig\/"}]}},"taxonomy_info":{"category":[{"value":397,"label":"Contracts"},{"value":225,"label":"Human Rights Issues"},{"value":247,"label":"Identity Theft"},{"value":110,"label":"Privacy"}],"post_tag":[{"value":422,"label":"Contracts"},{"value":424,"label":"Identity Theft"},{"value":298,"label":"privacy"},{"value":292,"label":"Reshika Dhir (IPilogue Editor)"}]},"featured_image_src_large":false,"author_info":{"display_name":"ccraig","author_link":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/author\/ccraig\/"},"comment_info":"","category_info":[{"term_id":397,"name":"Contracts","slug":"contracts","term_group":0,"term_taxonomy_id":397,"taxonomy":"category","description":"","parent":0,"count":90,"filter":"raw","cat_ID":397,"category_count":90,"category_description":"","cat_name":"Contracts","category_nicename":"contracts","category_parent":0},{"term_id":225,"name":"Human Rights Issues","slug":"human-rights-issues","term_group":0,"term_taxonomy_id":225,"taxonomy":"category","description":"","parent":0,"count":40,"filter":"raw","cat_ID":225,"category_count":40,"category_description":"","cat_name":"Human Rights Issues","category_nicename":"human-rights-issues","category_parent":0},{"term_id":247,"name":"Identity Theft","slug":"identity-theft","term_group":0,"term_taxonomy_id":247,"taxonomy":"category","description":"","parent":0,"count":18,"filter":"raw","cat_ID":247,"category_count":18,"category_description":"","cat_name":"Identity Theft","category_nicename":"identity-theft","category_parent":0},{"term_id":110,"name":"Privacy","slug":"privacy","term_group":0,"term_taxonomy_id":110,"taxonomy":"category","description":"","parent":0,"count":311,"filter":"raw","cat_ID":110,"category_count":311,"category_description":"","cat_name":"Privacy","category_nicename":"privacy","category_parent":0}],"tag_info":[{"term_id":422,"name":"Contracts","slug":"contracts","term_group":0,"term_taxonomy_id":422,"taxonomy":"post_tag","description":"","parent":0,"count":19,"filter":"raw"},{"term_id":424,"name":"Identity Theft","slug":"identity-theft","term_group":0,"term_taxonomy_id":424,"taxonomy":"post_tag","description":"","parent":0,"count":2,"filter":"raw"},{"term_id":298,"name":"privacy","slug":"privacy","term_group":0,"term_taxonomy_id":298,"taxonomy":"post_tag","description":"","parent":0,"count":152,"filter":"raw"},{"term_id":292,"name":"Reshika Dhir (IPilogue Editor)","slug":"reshika-dhir-ipilogue-editor","term_group":0,"term_taxonomy_id":292,"taxonomy":"post_tag","description":"","parent":0,"count":24,"filter":"raw"}],"_links":{"self":[{"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/posts\/3560","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/users\/2140"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/comments?post=3560"}],"version-history":[{"count":0,"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/posts\/3560\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/media?parent=3560"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/categories?post=3560"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yorku.ca\/osgoode\/iposgoode\/wp-json\/wp\/v2\/tags?post=3560"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}