Privacy Commissioners' Report Of Findings On Aggregate IQ : Challenges With Position On Service Providers' Obligations

On November 24, 2019, the federal Office of the Privacy Commissioner of Canada (OPC) and the Office of the Privacy Commissioner of British Columbia (BC OIPC) released their report of findings (the Report) arising from their joint investigation of Aggregate IQ Data Services Ltd (AIQ). Before the investigation, AIQ processed personal information as a service provider to several organizations involved with political campaigns located in foreign jurisdictions, among them SCL Elections Ltd., the parent company of Cambridge Analytica.

According to the Report, in its capacity as a service provider to organizations located in foreign jurisdictions, AIQ failed to ensure it had meaningful consent from the individuals whose personal information it collected, used, or disclosed, in contravention of Canadian privacy laws. The Report also concluded that AIQ failed to adequately protect personal information it held, and this failure was also a contravention of Canadian privacy laws.1

The reasoning behind the findings raises two questions:

How do Canadian privacy laws apply to a service provider when it is processing data on behalf of a client in a foreign jurisdiction? Must such a service provider police the consent and data collection practices of its client? We consider each of these questions in turn.

Application of Canadian Privacy Laws

The Report notes that AIQ is responsible for complying with consent requirements for its personal information handling practices in accordance with applicable Canadian or BC privacy laws, even where its clients are located in another jurisdiction.2 On the basis of this premise, the Report concludes that AIQ ought to have ensured that there was adequate consent (as that term is understood in Canadian law) for its collection, use, or disclosure of personal information on behalf of its foreign clients, in the same way as a service provider would need to do with respect to domestic Canadian clients.3

Arriving at that premise, however, requires an interpretation of the law that the statutory language and interpretation by Canadian courts do not clearly support. In some ways, the reasoning of the Report brings to mind the interpretation of "equality" as formal equality rather than substantive equality: the superficial application of rules in a way that fails to achieve balance in effects or outcomes.

Of course, Canadian privacy laws apply to AIQ. It does not follow, however, that service providers servicing clients governed by the laws of another jurisdiction must follow the consent requirements of Canadian law. As the Federal Court of Appeal reminded us in Englander v...