ARCHIVED—Federal and Provincial Regulations

The protection of personal information in Canada is governed by both provincial and federal privacy laws, the application of which will vary depending on a series of factors, including the location of an organization, the entities with which it transacts and whether or not the information travels across the provincial and / or international boundaries.

For private sector organizations that are contracting with the public sector, the federal government and the governments of British Colombia, Nova Scotia and Québec have some restrictions on the geographic location of the personal information or provisions on disclosure.

Other Canadian provinces do not have such restrictions.

Federal Regulations

Federal Legislation Governing Private Sector Entities

The Government of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) sets rules that organizations must abide by when collecting, using and disclosing personal information in the course of commercial activity. These rules apply to all commercial activity taking place within Canada and across international borders.

Federal Rules Governing Public Sector Entities and to private sector organizations under contract with the Federal Government (outsourcing)

In their activities, federal government entities are subject to the Privacy Act and private sector organizations are also subject to the Privacy Act once the enter into contract with the Federal Government. To guide government and private sector organizations conforming to the Privacy Act, the Government of Canada published a reference document Taking Privacy into account before making contractual decisions and a Privacy Protection Checklist. These two documents are providing guidelines when outsourcing contracts or activities from the Federal government.

Provincial Regulations

In some instances, provinces have sector specific legislation imposing restrictions and conditions on data transfers. Certain provincial privacy laws require government bodies to protect personal information when entering into contracts with third party providers. While contractors may not be directly subject to these privacy laws, they may be required to adjust internal procedures to conform to these acts when they enter into contracts with some provincial government entities.

British Colombia

The British Colombia Freedom of Information and Protection of Privacy Act defines the privacy rules that apply to provincial government entities and does contain provisions governing outsourcing relationships between government entities and third party providers. In particular, this legislation requires government bodies to ensure that service providers store, disclose or give access to personal information within Canada only.

Nova Scotia

Nova Scotia's Personal Information International Disclosure Protection Act prohibits the storage, disclosures and access to personal information outside of Canada. These provisions apply to information that is in the custody or control of a public body or municipality in Nova Scotia, as well as to service providers acting on behalf of a public entity. Some exceptions apply.

Quebec

Quebec's public sector privacy law, An Act Respecting Access to Documents Held by Public Bodies and the Protection of Personal Information, applies to documents kept by a public body, whether the information is kept by the public body or by a third party on its behalf. Main goal is to ensure that third party holding, using or releasing information on behalf of provincial entities must ensure that the information receive an equivalent level of protection as if it would be maintained by the public body itself.

Quebec private sector privacy law, An Act Respecting the Protection of Personal Information in the Private Sector sets rules that apply to private sector organizations located in Quebec. Legislation requires that Quebec based organizations must ensure that information receives an equivalent protection when they are dealing with organizations located outside provincial boundaries.

To complete the analysis of the current Canadian regulatory system, a clarification paper has been done by a Canadian legal counselor specialized in privacy law. Applying Canadian Privacy Law to Transborder Flows of Personal Information from Canada to the United States: A Clarification Kris Klein September 2008