OPC Concludes Review of Third-Party Data Consent Rules: Status Quo to Continue

The CMA applauds the Office of the Privacy Commissioner (OPC)’s decision to maintain the longstanding interpretation of PIPEDA – Canada’s private sector privacy law – regarding consent requirements for data transfers to third-parties for processing.

The consultation proposed reinterpreting PIPEDA to require consent for these transfers, including transfers within Canada, cross-border transfers, and transfers to service providers and affiliates.

The CMA responded to the consultation, noting concerns about consumer “consent fatigue”, disruptions in service for consumers, and significant operational consequences for organizations relying on third-party data processing (including non-profits and others providing critical services to consumers). Our submission urged the OPC to rely on the strength of the current approach.

Given the nature of data flows, consent is not the most effective form of responsible data governance. Organizations are responsible for their accountability chains, and for assessing and mitigating associated risks. Their reputations depend on it.

The decision by the OPC means consumers and organizations can expect stability on this issue while lawmakers at the Ministry of Innovation, Science and Economic Development (ISED) engage in ongoing consultations to modernize PIPEDA.

The CMA will continue to participate actively in ISED’s consultations on how the future state of the law should provide effective privacy protection in the context of transfers for processing, along with many other topics.

While the OPC’s position on transfers for processing remains unchanged until a reformed law is announced, we remind marketers engaged in third-party data processing of the importance of being transparent. Organizations should advise customers that their personal information may be sent to another jurisdiction for processing and that, while the information is in another jurisdiction, it may be accessed by the courts, law enforcement and national security authorities.

The CMA encourages organizations to review the CMA Guide to Transparency for Consumers for practical insights on how to provide clear, user-friendly information to consumers about how their personal information is collected, used and shared.

The CMA is committed to helping Canadian marketers maintain high standards of professional conduct and transparency through this guide, our mandatory Code of Ethics & Standards of Practice and other resources, which members can access here.

Questions or comments? E-mail us – we want to hear from you.