Planning on outsourcing your company’s email to Gmail? Or maybe you’re outsourcing your data storage to a server in the US? Recent changes to Alberta’s Personal Information Protection Act (PIPA) stipulate that organizations must notify people when they will be transferring personal information to a service provider outside of Canada. Take the example of the University of Alberta’s recent plan to use Google as an email provider (though as public body the university falls under FOIP, not PIPA). Such a change involves the hosting of personal information outside of Canada.  In the case of online transactions, which necessarily route credit-card clearing services through the US for approval purposes, there appears to be an exception.

The other major changes include breach reporting and notification obligations, which are a first in Canada. This means that, if a privacy breach occurs and it creates “a real risk of significant harm” to an individual, the organization must make a report to the Privacy Commissioner. 

The changes became law on May 1, 2010.  Information about the amendments and how they work is available at: www.oipc.ab.ca.

Calgary – 08:00 MST