Author(s):
Adam Kardash, Michael Fekete
Oct 27, 2021
Amendments to British Columbia’s public sector privacy legislation should be principles-based, as a prescriptive approach could render new provisions ambiguous and uncertain. This was a central theme that emerged during Osler’s October 2021 AccessPrivacy call hosted by Adam Kardash, Partner, Privacy and Data Management, and Michael Fekete, Partner, Technology.
Data residency rules under B.C.’s Freedom of Information and Protection and Privacy Amendment Act (FOIPPA) were first put in place in 2004. One core rule stated that, subject to exceptions, personal information under the control or custody of a B.C. public body or a service provider must be both stored and accessed only within Canada.
In 2019, FOIPPA was amended to add new authorizations for disclosing personal information outside of Canada, including for the temporary processing of personal information that does not involve access to the information by an individual and does not result in storage outside of Canada. There was also a recognition that public bodies could have access to cloud services and that, through these services and subject to strict requirements, data could temporarily be processed outside of Canada.
Bill 22 will provide a new rule that effectively allows for disclosure of personal information outside of the country, in accordance with regulations. As of the time of this call, the regulations still had not be released. This leaves concern about how the word “processing” will be interpreted.
There is every indication that the B.C. government wants to allow for greater use of digital tools and technology. However, there appears to be a disconnect between the rule that allows for processing outside of the country only on a temporary basis and the rule enabling storage outside of the country. This tension should be resolved under a principles-based approach to ensure Bill 22 fulfills its desired purpose.
Watch the Webinar on Demand