I will be getting my blog – the Privacy Inquisition – back into action; but first of all, I have been bringing in some content that I have been putting in other places, so it’s in all in one place.
No one expects the Privacy Inquisition. (dramatic music.)
This is a tough message to get from the EU; the Article 29 Working Party has identified some areas for improvement in order to find adequacy for Quebec’s Privacy Act (opinion linked here). Particularly harsh, I imagine, getting this by way of a voice mail message since Quebec was celebrating Saint-Jean-Baptiste Day on Tuesday; if they got any forewarning of the result, it was left via voice mail. Harsh.
I have hope that this will prompt changes that the Quebec Commission d’Acces a L’Information (CAI) have been asking for to their legislation; perhaps thoughts like servers leaving Montreal in a caravan down the 401 to Toronto, or even that the ROC (rest of Canada) is considered by the EU – the EU! – as adequate while Quebec is not, may prompt some speedy action…
Seriously, this is a shot across the bow for the provinces, for Canada, and for the world. I had done a presentation last year at the IAPP Canadian Symposium, on the topic of whether our adequacy finding was at stake. The EU had been pressing forward with its draft Regulation, and I speculated over whether we would need to update PIPEDA to maintain our status, and whether in fact provincial ‘substantially similar’ findings would not save the provinces from being reviewed for adequacy, since the draft Regulation contemplated reviews of adequacy of national subdivisions. This issue over Quebec, however, goes back as far as the WADA controversy in which the Working Party issued an opinion over the adequacy of Quebec’s law in relation to drug testing of athletes.
Well, the Working Party didn’t wait for the draft Regulation; they’ve started, and and while it is an advisory opinion, sets out a list of four areas for improvement that can only be interpreted as setting a standard for adequacy:
- clarifying the territorial application of the Quebec Privacy Act;
- strengthening transparency by requiring identification of the data controller;
- clarifying sensitive information; and most significantly,
- putting in place data agreements for onward transfers.
The last one has relevance for all of Canada – this is an issue raised with the Federal Commissioner’s Office, over the fact that transfers can take place from the EU to Canada freely, but there is no controls over onward transfers – say to the US. I think that this decision sets out not only expectations for Quebec, but for all of Canada, and is possibly also a message to the ‘league of the adequate’ nations as to what they will have to start doing to keep pace with changes in the EU.