The Canadian Equivalent to the PATRIOT Act

On January 27, 2009, the Office of the Privacy Commissioner of Canada released guidelines for processing personal data across borders. These guidelines explain how PIPEDA applies to personal information that is transferred to third parties for processing, including those located outside of Canada.

This guide will be of particular interest for individuals who are concerned about their personal information being transferred to third party organizations in the United States, namely because of the controversial PATRIOT Act which increases the ability of law enforcement agencies to access records held by American organizations.

Many Canadians are often uneasy about the notion that their personal information can be subject to American law enforcement agencies. However, unknown to many, PIPEDA actually allows Canadian law enforcement agencies to share information with U.S. intelligence agencies if warranted.

Highlighted in PIPEDA Case Summary #394, CanWest used these principles to explain that “government access without consent will always remain a possibility, both in Canada and in the United States.”

From PIPEDA, 7(3)c:

(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is

(c) required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records;

(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that

(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or

(iii) the disclosure is requested for the purpose of administering any law of Canada or a province;

(i) required by law.

Although the PATRIOT Act may allow American government officials easier access to personal information, Canadian legislation effectually allows the Canadian government to do the same. This is a legal risk that organizations must recognize.

But should you be worried?

According to PIPEDA Case Summary #394, Canadian organizations would normally be subject to such requests in the “national security and anti-terrorism context.”

It’s also important to note that section 215 of the PATRIOT Act could allow U.S. intelligence agencies to obtain your personal information from Canadian organizations anyways:

“Section 215 of the Patriot Act has proven to be a controversial provision in both the United States and Canada. Canada’s Privacy Commissioner and British Columbia’s Information and Privacy Commissioner have both expressed concerns that section 215 could allow U.S. intelligence agencies to obtain personal information about Canadians from U.S. companies with offices in Canada, or from U.S. companies in the United States who hold personal information of Canadians due to outsourcing contracts.”

Source: “The USA PATRIOT Act and Canada’s Anti-terrorism Act: Key Differences in Legislative Approach”

Canadians must realize that their personal information can be disclosed to government officials in either America or Canada without their consent if it is necessary for law enforcement.