Privacy and outsourcing for federal institutions - Office of the Privacy Commissioner of Canada

<!DOCTYPE html>   <html class="secondary no-js" lang="en" dir="ltr">  <head> <meta charset="utf-8" />  <title>Privacy and outsourcing for federal institutions - Office of the Privacy Commissioner of Canada</title> <meta content="width=device-width, initial-scale=1" name="viewport" />  <meta name="description" content="Guidance, relevant investigations" /> <meta name="dcterms.subject" title="scheme" content="Guidance, relevant investigations" /> <meta name="dcterms.title" content="Privacy and outsourcing for federal institutions" /> <meta name="dcterms.creator" content="Office of the Privacy Commissioner of Canada" /> <meta name="dcterms.issued" title="W3CDTF" content="2014-01-14" /> <meta name="dcterms.modified" title="W3CDTF" content="2014-01-14" /> <meta name="dcterms.language" title="ISO639-2" content="eng" /> <meta name="referrer" content="same-origin" />   <link href="/wet/gcweb-opc/assets/favicon.ico" rel="icon" type="image/x-icon" /> <link rel="stylesheet" href="/wet/gcweb-opc/css/theme.min.css" />    <noscript><link rel="stylesheet" href="/wet/wet-boew/css/noscript.min.css" /></noscript> <link rel="stylesheet" href="/css/opc-style.css" />  <link rel="stylesheet" href="/cms-css/feedback.css" /> <script type="text/javascript"> var _paq = (function (paq) { var removeTrailingSlash = function(site) { // if site has an end slash (like: www.example.com/), // then remove it and return the site without the end slash return site.replace(/\/$/, ''); // Match a forward slash / at the end of the string ($) } paq.push(['setCustomVariable', '1', 'Sections of the Site', 'Publications', 'page']); paq.push(['setCustomVariable', '2', 'Types of Publication', 'Guidance for organizations', 'page']); // Push the english url in lower case for consistent results var u = "/m/"; var url = removeTrailingSlash(window.location.href).toLowerCase(); var ipsource = 'external'; paq.push(['setCustomDimension', '2', url]); paq.push(['setCustomDimension', '3', ipsource]); paq.push(['setCustomUrl', url]); paq.push(['enableLinkTracking']); paq.push(['trackPageView']); paq.push(['trackVisibleContentImpressions']); paq.push(['setTrackerUrl', u + 'm.php']); paq.push(['setSiteId', '1']); var d = document, g = d.createElement('script'), s = d.getElementsByTagName('script')[0]; g.type = 'text/javascript'; g.async = true; g.defer = true; g.src = u + 'm.js'; s.parentNode.insertBefore(g, s); return paq; })(window._paq || []); </script> </head> <body class="secondary" vocab="http://schema.org/" typeof="WebPage"> <section aria-label="Skip to"> <ul id="wb-tphp"> <li class="wb-slc"> <a class="wb-sl" href="#wb-cont">Skip to main content</a> </li> <li class="wb-slc visible-sm visible-md visible-lg"> <a class="wb-sl" href="#wb-info">Skip to "About this site"</a> </li> </ul> </section> <header role="banner"> <div id="wb-bnr" class="container"> <section id="wb-lng" class="visible-md visible-lg text-right" aria-labelledby="lang-section"> <h2 id="lang-section" class="wb-inv">Language selection</h2> <div class="row"> <div class="col-md-12"> <ul class="list-inline margin-bottom-none"> <li><a lang="fr" hreflang="fr" href="/fr/sujets-lies-a-la-protection-de-la-vie-privee/employeurs-et-employes/externalisation/02_05_d_57_os_02/">Français</a></li> </ul> </div> </div> </section> <div class="row"> <div class="brand col-xs-8 col-sm-9 col-md-5"> <a href="/en"> <img class="visible-print-block" src="/wet/gcweb-opc/assets/opc-blk-en.png" alt=""> <img src="/wet/gcweb-opc/assets/opc-wht-en.png" class="hidden-print img img-responsive" alt="OPC Logo" /> <span class="wb-inv"> Office of the Privacy Commissioner of Canada</span> </a> </div> <section class="wb-mb-links col-xs-4 col-sm-3 visible-sm visible-xs" id="wb-glb-mn" aria-labelledby="search-menu-section"> <h2 id="search-menu-section">Search and menus</h2> <ul class="list-inline text-right chvrn"> <li> <a href="#mb-pnl" title="Search and menus" aria-controls="mb-pnl" class="overlay-lnk" role="button"> <span class="glyphicon glyphicon-search"> <span class="glyphicon glyphicon-th-list"> <span class="wb-inv">Search and menus</span> </span> </span> </a> </li> </ul> <div id="mb-pnl"></div> </section> <section id="wb-srch" class="col-xs-7 text-right visible-md visible-lg" aria-labelledby="search-section"> <h2 id="search-section">Search</h2> <form action="/en/search" class="form-inline" enctype="multipart/form-data" method="post" name="cse-search-box" role="search"> <div class="form-group"> <label for="wb-srch-q" class="wb-inv">Search website</label> <input id="wb-srch-q" list="wb-srch-q-ac" class="wb-srch-q form-control" name="t" type="search" value="" size="27" maxlength="150" placeholder="Search priv.gc.ca" /> <datalist id="wb-srch-q-ac">   </datalist> </div> <div class="form-group submit"> <button type="submit" id="wb-srch-sub" class="btn btn-primary btn-small" name="wb-srch-sub"><span class="glyphicon-search glyphicon"></span><span class="wb-inv">Search</span></button> </div> <input name='ufprt' type='hidden' value='4A98E4E5508309F3C9232B176FF11C4FCABAB4A2AFD0C401010F3E18024E02A8016D77B7A4E7D762EBBB5A69F3BF0208C087180EB2CDFD6301FD6979441E25E018A0268271D17CB5544C2F3B76381E4B9DC47A756A28F1D911BC19EDCD5E9D4CF60DB5253F117833F2339A563CEB2B9418462E5B44373A6574E868DE78AA8288' /></form> </section> </div> </div> <nav id="wb-sm" data-ajax-replace="/ajax/sitemenu-en" data-trgt="mb-pnl" class="wb-menu visible-md visible-lg" typeof="SiteNavigationElement" aria-labelledby="topics-menu-section"> <div class="container nvbar"> <h2 id="topics-menu-section">Topics menu</h2> <div class="row"> <ul class="list-inline menu"> <li><a href="/en/for-individuals/" class="item">For individuals</a></li> <li><a href="/en/for-businesses/" class="item">For businesses</a></li> <li><a href="/en/for-federal-institutions/" class="item">For federal institutions</a></li> <li><a href="/en/report-a-concern/" class="item">Report a concern</a></li> <li><a href="/en/opc-actions-and-decisions/" class="item">OPC actions and decisions</a></li> <li><a href="/en/about-the-opc/" class="item">About the OPC</a></li> </ul> </div> </div> </nav> <nav id="wb-bc" property="breadcrumb" aria-labelledby="you-are-here"> <h2 id="you-are-here">You are here:</h2> <div class="container"> <div class="row"> <ol class="breadcrumb"> <li><a href="/en/">Home</a></li><li><a href="/en/privacy-topics/">Privacy topics</a></li><li><a href="/en/privacy-topics/employers-and-employees/">Employers and employees</a></li><li><a href="/en/privacy-topics/employers-and-employees/outsourcing/">Outsourcing</a></li> </ol> </div> </div> </nav> </header> <main property="mainContentOfPage" class="container"> <div class="row"> <section class="col-md-8 pull-right" aria-label="Main content"> <div class="col-md-12"> <h1 id="wb-cont">Privacy and outsourcing for federal institutions</h1> </div> <div class="row"> <div class="col-md-12"> <div class="visible-print-block" style="margin: 40px 0;"></div>  <p>There is nothing in <em>Privacy Act—</em>the law that covers the personal information-handling practices of federal government departments and agencies—that prevents the outsourcing of data processing.</p> <p>The Act came into force more than 30 years ago and was not designed for the current digital age that allows for the rapid and easy movement of information around the globe. Our Office has repeatedly asked for provisions around the international transfer of personal data to be subject to a more rigorous legal regime.</p> <p>The Treasury Board of Canada Secretariat (TBS) has developed guidance documents related to outsourcing for federal organizations.</p> <p>It is important to note that TBS requires all federal departments and agencies to prepare and publish Privacy Impact Assessments (PIA) for any new or substantially modified programs or activities that use personal information for making decisions that directly affect individuals. Therefore, if an institution were to consider outsourcing some of its functions, it may prepare a PIA that describes the impact on the personal information of Canadians and submit it to the OPC before it implemented the program or service. Our Office would then determine whether the PIA required our review and if so we might provide comments and recommendations to the institution.</p> <h2>For more information:</h2> <h3>Treasury Board Secretariat Links</h3> <p><a href="https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/guidance-preparing-information-sharing-agreements-involving-personal-information.html">Guidance on Preparing Information Sharing Agreements Involving Personal Information</a></p> <p><a href="https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/privacy/guidance-document-taking-privacy-into-account-before-making-contracting-decisions.html">Guidance Document: Taking Privacy into Account Before Making Contracting Decisions</a></p> <p><a href="http://www.tbs-sct.gc.ca/pubs_pol/gospubs/tbm_128/usapa/backgrounder-document-eng.asp"><em>Privacy Matters: The Federal Strategy to Address Concerns About the USA PATRIOT Act and Transborder Data Flows</em></a></p> <p><a href="http://www.tbs-sct.gc.ca/pol/doc-eng.aspx?id=12510">Policy on Privacy Protection</a></p> <p><a href="http://www.tbs-sct.gc.ca/pol/doc-eng.aspx?id=18308">Directive on Privacy Impact Assessment</a></p> <h3><em>Privacy Act</em> Findings</h3> <p><a href="/en/opc-actions-and-decisions/investigations/investigations-into-federal-institutions/2009-10/pa_200910_03/">RCMP and private polling firm safeguarded data on gun licensees</a></p> <p><a href="/en/opc-actions-and-decisions/investigations/investigations-into-federal-institutions/2004-05/pa_200405_01/">Outside psychologist’s notes still “under control of” RCMP</a></p> <p><a href="/en/opc-actions-and-decisions/investigations/investigations-into-federal-institutions/2001-02/pa_200102_01/">Departments accountable for information collected under contract</a></p> <h3>Other Resources</h3> <p><a href="/en/opc-actions-and-decisions/research/funding-for-privacy-research-and-knowledge-translation/completed-contributions-program-projects/2010-2011/p_201011_03/">The Private Sector, National Security and Personal Data: An Exploratory Assessment of Private Sector Involvement in Airport and Border Security in Canada</a></p> <p>Privacy Commissioner expresses support for government's new strategy to deal with trans-border flows of personal information</p> </div> </div> </section> <div class="col-md-4 pull-left mrgn-tp-md"> <div class="hidden-print"></div> </div> <aside class="col-md-4 pull-left" aria-labelledby="relContent"> <section class="box box-opc box-opc-primary related-content" aria-labelledby="relContent"> <h2 id="relContent" class="h1">Related content</h2> <ul class="list-unstyled"> <li><a href="/en/privacy-topics/employers-and-employees/outsourcing/02_05_d_57_os_01/">Privacy and Outsourcing for Businesses</a></li> </ul> </section> </aside> </div> <div class="pagedetails"> <div class="row mrgn-tp-sm"> <div class="col-sm-6 col-md-5 col-lg-5" id="reportAProblem"> <i18n-host locale="en"> <feedback-problem feedback-api="https://api.priv.gc.ca/feedback/api/feedback" content-id="21170" version-id="267257"></feedback-problem> </i18n-host> </div> <div class="col-sm-6 col-md-4 col-md-push-3 col-lg-5 col-lg-push-2"><i18n-host locale="en"> <feedback-helpful feedback-api="https://api.priv.gc.ca/feedback/api/feedback" content-id="21170" version-id="267257"></feedback-helpful> </i18n-host></div> </div> <dl id="wb-dtmd"> <dt>Date modified: </dt> <dd><time property="dateModified">2014-01-14</time></dd> </dl> </div> </main> <footer id="wb-info"> <nav class="container visible-sm visible-md visible-lg wb-navcurr" aria-labelledby="footer-links"> <h2 class="wb-inv" id="footer-links">About this site</h2> <div class="row"> <div class="col-md-3"> <section aria-labelledby="about-opc-section"> <h3 id="about-opc-section">About the OPC</h3> <p>The Privacy Commissioner of Canada is an Agent of Parliament whose mission is to protect and promote privacy rights.</p> <ul class="list-unstyled"> <li><a href="/en/about-the-opc/who-we-are/">Who we are</a></li> <li><a href="/en/about-the-opc/what-we-do/">What we do</a></li> <li><a href="/en/about-the-opc/opc-operational-reports/">OPC operational reports</a></li> <li><a href="/en/accessibility/">Accessibility</a></li> <li><a href="/en/about-the-opc/publications/">Publications</a></li> <li><a href="/en/about-the-opc/working-at-the-opc/">Working at the OPC</a></li> </ul> </section> </div> <div class="col-md-3"> <section aria-labelledby="opc-news-section"> <h3 id="opc-news-section">OPC news</h3> <p>Get updates about the OPC’s announcements and activities, as well as the events in which we participate.</p> <ul class="list-unstyled"> <li><a href="/en/opc-news/news-and-announcements/">News and announcements</a></li> <li><a href="/en/opc-news/privacy-events/">Privacy events</a></li> <li><a href="/en/opc-news/speeches-and-statements/">Speeches</a></li> </ul> </section> </div> <div class="col-md-3"> <section aria-labelledby="respect-section"> <h3 id="respect-section">Your privacy</h3> <p><strong>We respect your privacy</strong></p> <p>Read our <a href="/en/privacy-and-transparency-at-the-opc/pp/">Privacy policy</a> and <a href="/en/privacy-and-transparency-at-the-opc/terms-and-conditions-of-use/">Terms and conditions of use</a> to find out more about your privacy and rights when using the <a href="/">priv.gc.ca</a> website or contacting the Office of the Privacy Commissioner of Canada.</p> </section> <section aria-labelledby="transparency-section"> <h3 id="transparency-section">Transparency</h3> <ul class="list-unstyled"> <li><a href="/en/privacy-and-transparency-at-the-opc/proactive-disclosure/">Proactive disclosure</a></li> </ul> </section> </div> <div class="col-md-3"> <section aria-labelledby="contact-us-section"> <h3 id="contact-us-section">Contact us</h3> <p>If you have a question, concerns about your privacy or want to file a complaint against an organization, we are here to help.</p> <a href="/en/contact-the-opc/" role="button" class="btn btn-default active">Contact the OPC</a> </section> <section aria-labelledby="stay-connected-section"> <h3 id="stay-connected-section">Stay connected</h3> <ul class="list-unstyled"> <li><span class="fa fa-comments"></span> <a href="/en/blog">OPC Blog</a></li> <li><span class="fa fa-linkedin-square"></span> <a href="https://www.linkedin.com/company/office-of-the-privacy-commissioner-of-canada">OPC LinkedIn</a></li> <li><span class="fa fa-rss-square"></span> <a href="/en/rss-feeds/">OPC RSS feeds</a></li> <li><span class="opc-icon"><img src="/wet/gcweb-opc/assets/x.svg" alt="X Account" title="X Account"/> </span> <a href="https://x.com/PrivacyPrivee">OPC @XAccount</a></li> <li><span class="fa fa-youtube"></span> <a href="https://www.youtube.com/user/PrivacyComm">OPC YouTube channel</a></li> </ul> </section> </div> </div> </nav> <div class="brand"> <div class="container"> <div class="row "> <div class="col-md-6"> <img src="/wet/gcweb-opc/assets/opc-blk-en.png" alt="OPC Logo" class="img img-responsive" /> <span class="wb-inv">Office of Privacy Commissioner of Canada</span> </div> <div class="col-md-6 tofpg text-right"> <a href="#wb-cont">Top of Page <span class="fa fa-arrow-circle-up"></span></a> </div> </div> </div> </div> </footer>  <script src="/wet/wet-boew/js/jquery/2.1.4/jquery.min.js"></script> <script src="/wet/wet-boew/js/wet-boew.min.js"></script>   <script src="/wet/gcweb-opc/js/theme.min.js"></script> <script src="/lib/feedbackform.client/dist/feedback.js"></script> </body> </html>

CINXE.COM

Privacy and outsourcing for federal institutions - Office of the Privacy Commissioner of Canada