OPC to consult ‘shortly’ on data transiting through foreign countries

The Office of the Privacy Commissioner considers personal data of Canadians transiting through the United States and other countries a “live issue” and will “consult widely” on it, its deputy commissioner of policy said Wednesday. “We’re currently taking a serious look at our transport data flow guidance and we intend, in the not-too-distant future, to consult widely on this guidance,” Gregory Smolynec said in front of the House of Commons public safety and national security committee. Smolynec was specifically addressing OPC guidelines published in 2009 dealing with how the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to transfers of personal information to third parties, including those outside of the country. “It’s a live issue for our office and we’re thinking deeply about it and trying to solicit input from various stakeholders,” he told the committee continuing its study of cybersecurity in the financial sector as a national economic security issue on Wednesday. In a follow-up email, OPC spokeswoman Tobi Cohen said that the consultation will be commencing “shortly.” She said at issue is how personal data is dealt when it leaves the country, “as well as other cross border disclosures of personal information between organizations.” An example of this type of transfer is when personal information is used for the purpose of processing payments. According to the OPC guidelines, “increasingly, organizations outsource processes to third parties,” which in many cases involves the transfer of personal information. “Regardless of where information is being processed -- whether in Canada or in a foreign country -- the organization must take all reasonable steps to protect it from unauthorized uses and disclosures while it is in the hands of the third party processor,” the guidelines say. When asked, Cohen noted that the issue “is more broad” than the question of internet traffic, which often passes through foreign destinations, before being repatriated in Canada. “We are dealing with cross border transfer between controllers and processors,” or organizations that handle data, she said. The issue of “boomerang traffic” has been raised as a concern by academic and internet experts previously, especially where that data is subject to the laws of the country where it flows. It has been a major concern with the election of U.S. president Donald Trump, who has made overtures about expanding the mandate of spy agency National Security Agency, and surveillance emanating from the U.S. Patriot Act. The issue is also a stipulation in a Statistics Canada contract for the 2021 census. “The Contractor must ensure that all domestic network traffic...is routed exclusively through Canada, unless the Contracting Authority has first consented in writing to an alternate route,” the tender said. In 2017, the Packet Clearing House estimated that roughly 64 per cent of Canadian traffic runs through the U.S. before being repatriated in Canada. About 27 per cent of the traffic stays in Canada and the remaining nine per cent crosses other countries. Late last year, the OPC published a bulletin on the issue of personal information crossing borders, saying despite federal privacy laws not prohibiting this outsourcing, Canadians should expect their information to be “protected and handled appropriately.” The issue of transiting data touches on another concern that has seen debate: localized data rules. The issue of whether laws should require businesses to have data storage facilities inside the country had been a NAFTA sticking point and data-localization rules were restricted in the new agreement. On Wednesday, this publication reported that the government was informed that there was criticism leveled at it for its cloud-first policy with respect to sensitive data. One of the government’s concerns with hosting data on a foreign commercial cloud provider would mean its data would be subject to the laws in the country in which it resides. Representatives of Amazon.com Inc. and IBM Corp. both told The Wire Report that the cloud allows for data localization and isolation. — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

OPC to consult ‘shortly’ on data transiting through foreign countries

News | April 5, 2019

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

OPC to consult ‘shortly’ on data transiting through foreign countries

News | April 5, 2019

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Local providers key to broadband rollout, CanWISP told

Telesat, feds announce new Gatineau campus

Iristel, Bell still in dispute over repayments, disconnections

Ford cancels Ontario Starlink deal, bans US companies from procurement in response to tariffs

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us