Outsourcing by Canadian Companies: Another Look at the USA PATRIOT Act

There may be no greater area of confusion and misunderstanding than fear of the PATRIOT Act” - Ontario Information and Privacy Commissioner

Cloud computing and data outsourcing has been embraced by many Canadian companies. In a recent poll, the adoption rate of cloud-based services by Canadian businesses experienced one of the highest year-over-year increases. Data security and concerns over personal information and privacy remain one of the biggest barriers to adoption.

One of the most common concerns raised by businesses who are considering cloud computing is the law known as Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (“PATRIOT Act”). There has been much discussion and some misinformation regarding the PATRIOT Act. For those unfamiliar with the topic, the central concern is that U.S. government authorities may use the provisions of the PATRIOT Act to access the personal information of Canadians where that information is stored in the United States, particularly in the context of outsourcing or cloud-computing.

Overall, a review of recent decisions in Canada shows that these concerns are overstated in light of the risks, and that for private sector businesses there are no prohibitions on outsourcing to the United States in light of the PATRIOT Act, provided (1) reasonable safeguards are built into the outsource contract (including confidentiality, use-restrictions, security, and provisions to meet monitoring and audit requirements), and (2) customers are notified in a clear way when their personal information will be stored or handled outside Canada. It is important to remember that the confidentiality and use-restrictions imposed on the service provider must be tied to the purposes to which the customers originally consented.

“Transparency and security” are watchwords for Canadian businesses considering the cloud.

Industry-specific regulations or guidelines, such as those found in the Insurance Companies Act and the OSFI guidelines applicable to banks and other financial institutions, place certain controls on outsourcing but do not specifically prohibit outsourcing or data-storage outside of Canada.  Canadian laws, as well as the PATRIOT Act and OSFI Guidelines are reviewed below.

1.         Federal Private Sector Legislation

The Personal Information Protection and Electronic Documents Act, (PIPEDA) governs federally-regulated entities, such as insurance companies. PIPEDA is also the default private-sector privacy legislation for provinces which have not passed “substantially similar” privacy legislation. To date, only Alberta, B.C. and Quebec have passed general private-sector privacy legislation that has been deemed “substantially similar” to PIPEDA.

PIPEDA governs the handling of personal information by private businesses such as insurance companies in the course of commercial activities. PIPEDA does not prohibit outsourcing of personal information to the U.S.  In fact, there is a clear decision of the Canadian Privacy Commissioner that PIPEDA does not prevent federally-regulated entities from outsourcing personal information data handling or data processing to the U.S.

2.         Provincial Privacy Legislation

There are multiple layers of regulation at the provincial level, for the public sector, private sector and for personal health information. Let’s have a look at the Alberta law. With respect to outsourcing, under the Alberta Personal Information Protection Act (PIPA) (sections 13 and 13.1), a service provider must notify consumers when personal information is stored by a service provider outside Canada. This includes a notification of the position or title of a person who is able to answer the consumer’s questions about the collection, use, disclosure or storage of personal information by the service providers outside Canada.  This is considered prudent practice for any private-sector organization engaging in outsourcing personal information to U.S. service providers.

Other than these notice requirements relating to storage of personal information outside Canada, there is no prohibition on outsourcing or data processing in the U.S. in private-sector privacy laws.

3.         USA PATRIOT Act

Regarding the PATRIOT Act, the Privacy Commissioner of Canada has stated that: “.. there is a comparable legal risk that the personal information of Canadians held by any organization and its service provider — be it Canadian or American — can be obtained by government agencies, whether through the provisions of U.S. law or Canadian law.” The Ontario Information and Privacy Commissioner has gone further and stated: “There may be no greater area of confusion and misunderstanding than fear of the PATRIOT Act. The PATRIOT Act has invoked unprecedented levels of apprehension and consternation – far more than I believe is warranted.”

The PATRIOT Act has been in effect for over 10 years, and during this time the Government of Canada states that there have been no instances where the personal information of a Canadian has been accessed under the PATRIOT Act.

Some public sector laws in B.C., Nova Scotia and Quebec require public bodies to ensure that personal information is stored only in Canada. For example, in B.C. public bodies and their service providers are obliged to notify the government if the public body receives “a foreign demand” for personal information. This is designed specifically to address PATRIOT Act concerns.

In Alberta, the public sector Freedom of Information and Protection of Privacy Act, permits a public body to disclose in response to a “subpoena, warrant or order” issued by a court, as long as the court has “jurisdiction in Alberta.” While no prohibition on outsourcing to the U.S. is explicitly built into the Alberta law, this provision is intended to ensure that the public body is constrained in its ability to disclose to a court of a foreign (U.S.) jurisdiction. Once again, it should be noted that this is public sector legislation.

Several privacy commissioner decisions have directly considered the issues raised by the PATRIOT Act in the context of Canadian public and private sector privacy laws.

  • In a 2005 decision, the Privacy Commissioner of Canada decided that PIPEDA does not prohibit the use of foreign-based third-party service providers, but it does oblige Canadian-based organizations to have provisions in place, when using third-party service providers, to ensure a comparable level of protection (including guarantees of confidentiality and security of personal information). The Commissioner’s decision was also clear that, at the very least, a company in Canada that outsources information processing to the U.S. should notify its customers that the information may be available to the U.S. government or its agencies under a lawful order made in that country.
  • Again in 2006 and 2008, the Privacy Commissioner of Canada decided that data handling in the U.S., which exposed the personal information to potential PATRIOT Act concerns, did not offend PIPEDA since the Canadian company had implemented comprehensive strategy and techniques to safeguard the personal information.   
  • Most recently, a June 2012 decision of the Information and Privacy Commissioner of Ontario reviewed a complaint about PATRIOT Act concerns with the outsourcing of personal information to the U.S. by an Ontario public body (the Ministry of Natural Resources). The Commissioner decided that the Ministry’s collection, use and disclosure of personal information for the purpose of administering the Ministry’s hunting and fishing licensing program was in compliance with the Act.

All of these decisions point to the need for transparency and openness when dealing with customers, to ensure that they are made aware in cases where personal information handling, processing or storage may or will be outsourced to the U.S. Secondly, the service or outsourcing agreement must contain contractual protections ensuring confidentiality, security and compliance with privacy laws, so that service provider provides a comparable level of protection for the personal information.

4.         OSFI Guideline B-10: Outsourcing of Business Activities, Functions and Processes

OSFI’s Guideline B-10  describes requirements for federally-regulated entities (FREs), such as banks, financial institutions and insurance companies, when engaging in outsourcing. These are the guidelines relevant to the issue of outsourcing to foreign jurisdictions. Generally, these guidelines mandate appropriate security and data confidentiality protections.   

Guideline 7.1.1(j) (“Confidentiality, Security and Separation of Property”) says: “At a minimum, the contract or outsourcing agreement is expected to set out the FRE’s requirements for confidentiality and security. Ideally, the security and confidentiality policies adopted by the service provider would be commensurate with those of the FRE and should meet a reasonable standard in the circumstances. The contract or outsourcing agreement should address which party has responsibility for protection mechanisms, the scope of the information to be protected, the powers of each party to change security procedures and requirements, which party may be liable for any losses that might result from a security breach, and notification requirements if there is a breach of security.”

OSFI also expects “appropriate security and data confidentiality protections to be in place. The service provider is expected to be able to logically isolate the FRE’s data, records, and items in process from those of other clients at all times, including under adverse conditions.”

In Guideline 7.2.2 (“Location of Records”) OSFI indicates that: “In accordance with the federal financial institutions legislation, certain records of entities carrying on business in Canada should be maintained in Canada. In addition, the FRE is expected to ensure that OSFI can access in Canada any records necessary to enable OSFI to fulfill its mandate.” This is intended to cover information such as accounting records, incorporation documents, corporate by-laws, rather than personal information.

Guideline 7.2.4 (“Outsourcing in Foreign Jurisdictions”) indicates the following: “When the material outsourcing arrangement results in services being provided in a foreign jurisdiction, the FRE’s risk management program should be enhanced to address any additional concerns linked to the economic and political environment, technological sophistication, and the legal and regulatory risk profile of the foreign jurisdiction(s).”

Once again, this speaks to the need for enhanced attention to security rather than any outright prohibition on outsourcing to the U.S.

5.         Breaches in Alberta

The Alberta Privacy Commissioner’s 2012 Breach Report shows that a majority (64%) of the 63 reported cases meeting the real risk of significant harm threshold involved human error or lost or stolen unencrypted electronic devices:

  • 22 breaches (35%) were caused by human error. These incidents included inappropriate disposal of personal information, misdirected emails or faxes, loss of files and portable media, and unauthorized disclosure of passwords. The most common form of human error was mail and courier errors caused by delivery to the wrong recipient. 
  • 18 breaches (29%) were caused by theft, such as office and car break-ins. 
  • 14 breaches (22%) were caused by electronic system compromises, typically through targeted attacks by external hackers.
  • 9 breaches (14%) were caused by a failure to adequately control access to electronic or paper files.

None of the cases involved a disclosure or breach through the PATRIOT Act. And it should be noted that hackers can access records on both Canadian and U.S. servers, so in that sense no additional risk is associated with outsourcing to the U.S.

Conclusion

Many concerns have been raised about the reach of the PATRIOT Act. It should be remembered that Canadian government authorities have similar powers to access personal information in the course of investigations, and to respond to requests by their allies, such as the U.S. in investigations.

This review of recent decisions in Canada demonstrates that private sector businesses are not prohibited from outsourcing to the United States in light of the PATRIOT Act. However, Canadian companies are well advised to implement reasonable safeguards and build these safeguards into the outsource contract. Secondly, customers should be notified in a clear way when their personal information will be stored or handled outside Canada.

Calgary - 07:00

No comments yet. Be the first.

Leave a reply

You must be logged in to post a comment.


Deprecated: Function set_magic_quotes_runtime() is deprecated in /home/rstobbe/ipblog.ca/wp-content/themes/rstobbe/style.php on line 118

Deprecated: Function set_magic_quotes_runtime() is deprecated in /home/rstobbe/ipblog.ca/wp-content/themes/rstobbe/style.php on line 125
orlistat can i buy orlistat online purchase generic xenical online purchase xenical no visa online without prescription orlistat for sale cheapest place to buy orlistat buy online rx xenical without orlistat online no prescription buy cheap generic xenical online canada pharmacy no prescription order xenical without rx orlistat overnight without prescription buy generic orlistat online no prescription xenical without a rx ordering xenical over the counter order orlistat online overnight shipping buy xenical online with overnight delivery discount orlistat cytotec purchase without prescription buy cheap generic vantin online canada pharmacy no prescription generic 20mg benicar online how to get prescription of lamictal buy vantin in uk how to get keflex without zovirax usa buy cheap desogen with dr. prescription feldene without script purchasing benicar canadian zovirax diet pills without a prescription purchase cycrin pay pal online without prescription buy desogen online overnight buy cheap zovirax online tenormin without rx revia in canada how to buy asacol online without rx buy vantin tablets without prescription buy atarax amex online without rx purchase cheap online principen zovirax with out a prescription where to buy cheap zovirax no prescription feldene available at health department desogen purchased online without prescription keflex precio buy keflex c o d buy benicar doctor prescription order desogen amex online without prescription buy online desogen without rx zovirax apotheke buy vantin no rx wholesale zovirax cheap lamictal 100mg generic asacol 400 mg buy zovirax online overnight arcoxia ordering generic benicar no prescription i want a zovirax prescription lamictal ordering without a dr casodex no rx canadian prescriptions keflex keflex with no prescription and delivered over night revia online online us pharmacy zovirax buy revia epharmacist tenormin without prescriptions in usa keflex online consultation overnight purchase revia online no membership overnight shipping buy revia in england order benicar on line buy tenormin online without script canadian vantin diet pills without a prescription buy atarax on line amex buy tenormin overnight delivery buy vantin overnight orlistat online order buying xenical without a prescription purchase orlistat without prescription to ship overnight order xenical no visa order xenical no prescription buy orlistat on line amex medikament orlistat orlistat suppliers xenical on line no prescription order cheap overnight xenical xenical prescription online next day delivery buy in orlistat uk generic xenical online xenical no prescription needed 120mg orlistat online pharmacy where to buy xenical no prescription order overnight xenical xenical with no r x and free shipping purchase orlistat prescription online buy xenical without a prescription in the united states buying xenical online orlistat buy no prescription orlistat overdose order orlistat without a rx overnight shipping no prescription xenical on line pharmacy xenical without a prescription or membership orlistat generic can i buy orlistat online xenical from mexico us xenical fedex xenical overnight no script mastercard accepted buy xenical online cheap cheap xenical no prescription ordering xenical from canada without a prescription where can i get orlistat without a prescription ordering xenical online without a prescription buy discount orlistat xenical free consultation fedex overnight delivery how to purchase xenical online without rx xenical for sale without prescription where can i buy some orlistat online only using cash or money orders xenical no physician approval online prescriptions xenical pharmacy where you can purchase xenical xr online xenical no doctors prescription orlistat 120 mg low price rx online website orlistat purchase xenical cod overnight delivery buy xenical next day delivery order overnight orlistat buy orlistat australia orlistat 120mg tablets express shipping orlistat online no prescriptions required from the us order xenical where can i buy orlistat over the counter orlistat buy fedex purchase orlistat amex online without rx 60 mg orlistat order xenical cheap overnight order orlistat without rx how to get xenical without buy xenical cost no script Xenical Orlistat generic Xenical shipped overnight without a prescription generic Orlistat without prescription purchase Xenical online with overnight delivery buy cheap generic Orlistat online canada pharmacy no prescription Buy cheap Xenical without a prescription purchasing Orlistat Xenical without rx buy Orlistat online without prescription orlistat online pharmacy is it legal to buy Orlistat online order xenical online overnight shipping buy orlistat legally order orlistat online consultation xenical shipped overnight no prescription xenical overnight without prescription xenical no prescription worldwide buy xenical without a prescription online generic 60mg orlistat online xenical ordered without a perscription where can i buy orlistat without prescriptions Pay COD for Xenical without prescription purchase Xenical online without prescription ordering Xenical online without a prescription no rx needed for purchasing Xenical how to get a Xenical rx no prescription Xenical Orlistat order Us Xenical fedex UK medication Orlistat Xenical buy online Xenical with no prescription overnight shipping Orlistat cheapest place to order order Orlistat no prescription no prescription xenical buy Orlistat 60mg where to buy xenical no prescription no fees buy Xenical cheap without prescription buying Xenical without a script Xenical overnight fed ex no prescription Purchase Xenical cod cash delivery where can i get Orlistat without a prescription buy xenical amex online generic orlistat canada xenical online with next day shipping xenical without a presciption no prescription orlistat cod delivery order cheap overnight xenical i need to order xenical without presciption and order it cod orlistat online no prescription and overnight no prescription required for xenical online pharmacy orlistat no prescription online overnight shipping xenical el orlistat generico orlistat from canada xenical no rx foreign buy orlistat c o d order buy orlistat online generic orlistat xenical buy online without rx no prescription xenical canadian generic orlistat no prescription buy xenical 120mg no rx orlistat generic orlistat without prescription canada buy orlistat pills no prescription orlistat online no prescription xenical online purchase xenical orderd online without prescription xenical in canada xenical no physicisn consult orlistat online order xenical no script fedex canadian prescriptions xenical purchase orlistat no visa without prescription buy xenical 120mg buy orlistat no prescriptions online purchase xenical order xenical cheap overnight purchase cheap orlistat cod free fedex how to get orlistat online no prescription in 120 days cheap orlistat usa xenical over night buy cheapest orlistat purchase xenical online no membership purchase orlistat prescription online how to buy xenical online without a rx no prescription generic xenical orlistat online prescription orlistat 120 mg without a prescription orlistat available canada cheap orlistat no prescription indian xenical purchase xenical online without script xenical online with no prescription or membership orlistat order on line purchase orlistat free consultation i want to buy orlistat without a perscription buy orlistat online without prescription from canada buy genuine orlistat online cheap order rx orlistat buy orlistat pills no prescription orlistat buy online in stock orlistat in usa buy orlistat in england orlistat for sale order orlistat without rx needed purchase orlistat without rx needed order orlistat without rx needed orlistat buy online in stock buy xenical online cheap xenical online order buy xenical no visa without rx orlistat order on line buy discount orlistat purchase orlistat usa cod orlistat sale no prescription xenical without a presciption buy generic orlistat canada buy orlistat online order xenical amex online without prescription buy xenical tablets without prescription (buy orlistat pills|buy Orlistat oral) (ordering orlistat from canada without a prescription|Orlistat purchase without perscripotion|buy cheap generic Orlistat online canada pharmacy no prescription|buy generic Orlistat online no prescription quick delivery|buy Orlistat online without prescription from canada|buy Orlistat without rx|cheap Orlistat no prescription|Orlistat online|how to order Orlistat|i need to order Orlistat without a prescription|low price rx online website Orlistat|online pharmacy Orlistat no prescription|Orlistat generic sale|Xenical without prescription|where can i get Orlistat without a prescription|Orlistat cheap online) (prescription orlistat|Orlistat online purchase|buy Xenical australia|Orlistat online cheap|order Orlistat without rx|UK medication Orlistat Xenical buy online|where to purchase Orlistat oral cheap) (order orlistat mastercard|canadian generic Orlistat no prescription|non prescription Orlistat) no prescriptions needed for xenical (orlistat 120mg tablets express shipping|Orlistat without prescription|order Orlistat online overnight shipping|Orlistat for sale without prescription|Orlistat without rx) xenical prescription online next day delivery xenical prescription from doctors online (orlistat no doctors prescription|buy discounted Orlistat online|buy non prescription drugs generic Orlistat|buy Orlistat online without prescription from canada|buy Orlistat next day delivery|canadian pharmacy Orlistat|generic Orlistat from india|how to buy Orlistat without a prescription|how to get Orlistat|Orlistat online no prescription 120 mg|Orlistat online without prescription|Orlistat to buy in canada|Orlistat with out a prescription) xenical overnight delivery fed ex next day fedex shipping for xenical buy on line orlistat getting orlistat without doctor buy orlistat cheap without prescription orlistat express online buy orlistat without a prescription in the united states how to buy orlistat without a prescription no rx needed for purchasing xenical no prescription orlistat buy orlistat over the counter xenical sale no prescription order orlistat no visa cheap orlistat without a prescription get orlistat without prescription generic orlistat prices orlistat overnight delivery fed ex purchase orlistat online no membership overnight shipping overnight xenical without a prescription i want a xenical prescription order generic xenical online no prescription orlistat no rx buy orlistat no visa without rx buy cheap xenical without prescription buy cheap orlistat line where can i buy orlistat without a prescription buy orlistat australia generic orlistat canada generic orlistat no prescription (buy orlistat canada|generic Orlistat no prescription|Orlistat oral tablet no prescription discount|non prescription Orlistat|ordering Orlistat online without a precription|Orlistat online without a prescription) buy orlistat canada xenical without script buy no prescription xenical fedex xenical overnight without a rx purchase xenical amex online without prescription online overnight shipping xenical how to get orlistat online no prescription in 120 days order xenical without rx xenical online consultation overnight orlistat cost xenical without script xenical without a prescription overnight shipping buy no prescription xenical order xenical without rx from us pharmacy generic xenical no prescription problems with buying orlistat without rx buy orlistat online without a prescription generic xenical without a precsriptions buy line orlistat online pharmacy no prescription orlistat buy xenical free consultation buy orlistat no scams order generic orlistat online no prescription buy orlistat free consultation online consultation for xenical orlistat without prescription shipped overnight express purchase xenical money purchase buy orlistat usa generic xenical no prescription purchase online prescription xenical buy orlistat without a rx overnight delivery how to order orlistat online without a rx buy orlistat without rx order orlistat online overnight shipping purchase xenical usa cod buy xenical online with no perscription buy orlistat from india cheap xenical for sale online no prescription required buy Maxalt drugs Maxalt online prescription buy Maxalt us how to buy arimidex arimidex 1mg side effects order arimidex overnight arimidex purchase overnight delivery order arimidex online no prescription buy generic arimidex uk Maxalt apotheke buy Maxalt epharmacist buy Maxalt legally Maxalt online no prescription buy Maxalt online us pharmacy order Maxalt no rx Maxalt buy Maxalt buy Maxalt no prescription uk buy Maxalt online purchase Maxalt buy Maxalt in england Maxalt overnight cod ordering maxalt online buy Maxalt cash on delivery Maxalt cheap mexican uk buy Maxalt Maxalt rezept buying Maxalt online discount Maxalt buy Maxalt visa no prescription Maxalt purchase cheap online Maxalt buy Maxalt american express Maxalt by mail buy Maxalt online us pharmacy buy Maxalt online now non rx cheap Maxalt purchase Maxalt online buy maxalt mastercard Maxalt prices Maxalt online prescription Maxalt tablets Maxalt prices Maxalt fedex shipping Maxalt 10mg buy Revia buy revia without a percsription order rx free tenormin canadian pharmacy no prescription asacol order cycrin 10 mg without prescription purchase asacol online no membership order buy arcoxia online buy vantin without a rx buy casodex without a prescription to ship overnight ordering benicar over the counter generic vantin uk Keflex without script order Atarax without rx needed Keflex available canada buy Keflex diet pill Tenormin fedex cytotec 100 mg without prescription buy requip 1mg buy requip online usa order requip canada cheap requip online how to buy requip online pharmacy Maxalt purchase maxalt without prescription to ship overnight buy Maxalt diet pills buy genuine Maxalt online buy pharmacy Maxalt waterview buy Maxalt Maxalt bestellen Rizatriptan Maxalt buy Maxalt usa buy Maxalt on line buy 1 mg Arimidex uk cheap Arimidex buy Arimidex 1mg canada buy Arimidex 1 mg online can i get Arimidex without rx buy 1mg Arimidex