Front Lines is a guest viewpoint section offering perspectives on current issues and events from people working on the front lines of Canada's technology industry. Terry McQuay is the President of Nymity, a privacy research firm that provides privacy education, risk mitigation subscription solutions and research services for corporations and not-for-profit organizations.
Outsourcing in Canada is changing because of privacy laws, changes in government outsourcing policies and business concerns resulting from the USA PATRIOT Act.
Increasingly, Canadian service providers are finding themselves with a competitive advantage simply because they keep their customers' data in Canada. Conversely, U.S.-based service providers are finding themselves at a disadvantage, often scrambling to move their data processing to Canada.
Background
Privacy laws in Canada provide consumers with the ability to file complaints on organizations located in Canada with provincial and/or federal privacy commissioners' offices. Complaints typically result from real or perceived mishandling of the consumer's personal information by the organization, but consumers can file complaints even if they are not directly subject to the privacy issue or breach.
Privacy laws also provide the privacy commissioners' offices with the power to investigate consumer complaints and an obligation to identify, expose and where possible influence privacy issues that have an impact on Canadians. Over the past year, privacy commissioners in Canada have increased their focus on cross-border transfers of personal information. This privacy issue results from personal information being sent to locations that don't have the same level of legislated privacy protections as Canada does.
Although offshore transfers to countries like India (that don't have privacy laws) might seem like the logical target for this increased focus on cross-border transfer of information, they're not. Organizations that outsource to India typically have contractual and other means to secure personal information, thus providing more than adequate privacy protections. The focus is on the U.S. The U.S. PATRIOT Act is considered by some to be anti-privacy because it provides U.S. federal authorities seemingly unfettered access to any personal information held by U.S. firms, whether it is on U.S. citizens, Canadians, or anyone.
Cross-Border Privacy Concerns
Privacy laws give consumers the ability to complain, and provide privacy commissioners the powers to investigate these complaints. But do consumers really care if their personal information is transferred to the U.S.?
As a Canadian, ask yourself these questions:
"Would I like my personal information reviewed by a U.S. authority, like the FBI?"
"Would I like my purchasing habits, my medical information and my resume accumulated and accessed by U.S. government agencies?"
If you answered 'no' to these questions, you are not alone. According to a survey published in June 2005, and conducted by EKOS Research Associates on behalf of the Privacy Commissioner of Canada, 64 per cent of Canadians have serious concerns about companies transferring their personal information to the U.S.
Privacy Commissioners Influence Corporate Outsourcing Policies
Cross-border transfers of personal information are a major concern of privacy commissioners across Canada, and they have taken many steps to build the awareness of this issue. The Office of the Privacy Commissioner of Canada has stated on several occasions:
"At the very least, a company in Canada that outsources information processing in this way should notify its customers that the information may be available to the U.S. government or its agencies under a lawful order made in that country."
In a recent precedent-setting finding from the federal commissioner's office about a complaint of an organization's transfer of personal information outside of Canada, the finding stated that an organization must comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), the law that governs all customer personal information transferred to the U.S. by corporations in Canada.
