Many thanks to Dan Michaluk [1] at All About Information [2] for the heads up that the Privacy Commissioner has new Guidelines for Processing Personal Data Across Borders [3].
Processing? According to the Commissioner:
PIPEDA does not distinguish between domestic and international transfers of data.
Processing
“Processing” is interpreted to include any use of the information by the third party processor for a purpose for which the transferring organization can use it.
Here at Slaw we have talked about outsourcing [4] on occasion. It is somewhat comforting to have a document to point our sources at to guide the way Canadian personal information must be treated.
I have to wonder if these guidelines were drafted after this complaint [5].