CPPA: Transfers Of Personal Information To Service Providers

• Published date: 24 November 2020
• Subject Matter: Privacy, Technology, Data Protection, Privacy Protection, Security
• Law Firm: McCarthy Tétrault LLP
• Author: McCarthy Tetrault LLP and Barry B. Sookman

The Consumer Privacy Protection Act (CPPA) will make substantial changes to Canada's privacy law. As noted previously, the bill includes many of the provisions in the Personal Information Protection and Electronic Documents Act (PIPEDA), plus a lot more. In some cases, it builds on the provisions of PIPEDA, on the guidance and decisions of the Commissioner, but includes changes designed either to clarify or change the law. A case in point are the very important new provisions which address transfers of personal information to service providers.

Transfers for processing under PIPEDA

Many organizations provide third parties with personal information to help them carry on their businesses. The organizations obtain consents from individuals for those uses, but not for the myriad of transfers relied on to fulfill the purposes for which the consents are obtained. The practice is pervasive including everything from payment processing, cloud and SAAS service solutions, business processing, and IT outsourcing. Given our integrated economy, especially with the United States, trans-national transfers of personal information take place all the time.

PIPEDA permits transfers of personal information for processing including across borders. It deals with such transfers under the accountability principle in Principle 4.1.3 of the CSA Model Code.

4.1.3 An organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.

The OPC made a number of findings related to transfers of personal information in its complaint investigations over the years. In its 2009 Guidelines for processing personal data across borders it summarized its interpretation of PIPEDA as follows:

• PIPEDA does not prohibit organizations in Canada from transferring personal information to an organization in another jurisdiction for processing.
• PIPEDA does establish rules governing transfers for processing.
• A transfer for processing is a "use" of the information; it is not a disclosure Assuming the information is being used for the purpose it was originally collected, additional consent for the transfer is not required.
• The transferring organization is accountable for the information in the hands of the organization to which it has been transferred.
• Organizations must protect the personal information in the hands of processors. The primary means by which this is accomplished is through contract.
• No contract can override the criminal, national security or any other laws of the country to which the information has been transferred.
• It is important for organizations to assess the risks that could jeopardize the integrity, security and confidentiality of customer personal information when it is transferred to third-party service providers operating outside of Canada.
• Organizations must be transparent about their personal information handling practices. This includes advising customers that their personal information may be sent to another jurisdiction for processing and that while the information is in another jurisdiction it may be accessed by the courts, law enforcement and national security authorities.

The Guideline has been consistently applied by the OPC, with the exception of during a short period during which the Commissioner re-interpreted transfers of personal information as disclosures and not uses thus requiring consents for such transfers. See, Barry Sookman, OPC consultation on trans-border data flows: my submission to the consultation, Barry Sookman, OPC drops transborder transfer of data consultation.

PIPEDA did not define the phrase "comparable level of protection". The 2009 Guidelines did, construing it as follows:

"Comparable...