Legal news and trends for Canadian in-house counsel and c-suite executives
Issue link: https://digital.canadianlawyermag.com/i/50877
Privacy Laws and Regulations Around the Globe: The Impact on Doing Business Internationally important issue as business operations become increasingly global in nature. Coupled with the Internet enabling personal data to be distributed almost instantaneously across the globe, privacy has quickly become a critical international concern that can often be confusing due to a global patchwork of laws and regulations. A US organization conducting business in multiple foreign jurisdictions must be aware privacy laws are not equal everywhere. Unless the most restrictive regulatory regime is adopted, country by country procedures may be necessary. T Canada While Canada is often assumed to be similar to the US with respect to business practices, privacy regulation is another matter. The Canadian approach to confidentiality and the transfer of personal information is much more in line with the European model than that of the US. (It was, in fact, designed to be this way.) The federal personal information protection regime in the Canadian private sector is mainly governed by the Personal Information Protection and Electronic Documents Act (PIPEDA), which became effective in 2004 and extends privacy protection to all personal data collected by companies on individuals in the course of commercial activity, except employees other than those of a federal undertaking. It follows that, in most cases, personal information of employees is regulated by applicable provincial law. Only Alberta, British Columbia and Quebec have enacted privacy legislation. That provincial legislation, however, is substantially similar to PIPEDA. Ontario has enacted privacy legislation but only with regard to personal health information. It is important to note that when transferring personal information outside of Canada, the transferring organization has an obligation to provide a comparable level of protection meaning the level of protection provided by the third party must be comparable to the he protection of personal information is an Christine A. Carron LITIGATION - MONTRÉAL T: 514.847.4404 CCARRON@OGILVYRENAULT.COM Martha A. Healey LITIGATION - OTTAWA T: 613.780.8638 MHEALEY@OGILVYRENAULT.COM level of protection afforded the personal information within Canada. The Privacy Commissioner of Canada has ruled that, not withstanding the USA PATRIOT Act, personal information transferred to the US can benefit from protection similar to that enjoyed in Canada. She added, however, that notice must be given to individuals alerting them to the fact their information will be stored in the US where it becomes subject to the USA PATRIOT Act. Another recent, high-profile example involved Facebook, the hugely popular social networking site. On July 16, 2009, Canada's Privacy Commissioner ruled that Facebook was in breach of Canadian privacy laws on several fronts, particularly with respect to the circumstances surrounding consent to the disclosure of personal information to third party application developers and the retention of personal information of users who had closed their accounts. Initially, Facebook resisted complete compliance with the Privacy Commissioner's recommendations. However, given the Commissioner's ability to submit the matter to the courts, Facebook ultimately proposed solutions satisfying Canadian privacy laws. As Facebook learned, a "global" approach to privacy works only where the privacy policy is written so as to comply with all jurisdictions in which an organization does business. Facebook recently indicated that it plans to amend worldwide practices to implement Canadian privacy requirements globally. Another recent example illustrating this is the case of Abika.com, a US-based online data broker. On July 31, 2009, after a nearly five-year investigation, the Privacy Commissioner ruled Abika had violated Canadian privacy laws by disclosing the personal information of Canadians without their knowledge or consent to third parties.