On January 27, 2009, the Office of the Privacy Commissioner of Canada released guidelines for processing personal data across borders. These guidelines explain how PIPEDA applies to personal information that is transferred to third parties for processing, including those located outside of Canada.
This guide will be of particular interest for individuals who are concerned about their personal information being transferred to third party organizations in the United States, namely because of the controversial PATRIOT Act which increases the ability of law enforcement agencies to access records held by American organizations.
Many Canadians are often uneasy about the notion that their personal information can be subject to American law enforcement agencies. However, unknown to many, PIPEDA actually allows Canadian law enforcement agencies to share information with U.S. intelligence agencies if warranted.
Highlighted in PIPEDA Case Summary #394, CanWest used these principles to explain that “government access without consent will always remain a possibility, both in Canada and in the United States.”
From PIPEDA, 7(3)c:
Although the PATRIOT Act may allow American government officials easier access to personal information, Canadian legislation effectually allows the Canadian government to do the same. This is a legal risk that organizations must recognize.
But should you be worried?
According to PIPEDA Case Summary #394, Canadian organizations would normally be subject to such requests in the “national security and anti-terrorism context.”
It’s also important to note that section 215 of the PATRIOT Act could allow U.S. intelligence agencies to obtain your personal information from Canadian organizations anyways:
“Section 215 of the Patriot Act has proven to be a controversial provision in both the United States and Canada. Canada’s Privacy Commissioner and British Columbia’s Information and Privacy Commissioner have both expressed concerns that section 215 could allow U.S. intelligence agencies to obtain personal information about Canadians from U.S. companies with offices in Canada, or from U.S. companies in the United States who hold personal information of Canadians due to outsourcing contracts.”
Canadians must realize that their personal information can be disclosed to government officials in either America or Canada without their consent if it is necessary for law enforcement.