On September 23, 2019, the Office of the Privacy Commissioner of Canada (“OPC”) announced that it completed its consultation on transfers for processing and that the OPC’s current guidelines for processing personal data across borders remain unchanged. Under these guidelines, consent for transfers to data processors generally is not required.
The OPC launched its consultation on the issue of transfers for processing on April 9, 2019, after investigating the massive Equifax data breach and finding that consent was required, but not obtained, for the transfer of personal information from Equifax Canada for processing by its U.S. affiliate. That conclusion was in tension with the OPC’s guidelines, which generally require that companies obtain consent to disclose personal data to controllers but not to processors, regardless of location. The OPC proposed erasing this distinction and requiring businesses to obtain consent before transferring data to processors. The OPC received 87 comments, the vast majority of which opposed the proposal.