The court emphasized the importance of privacy protection, but concluded that "the contractual provisions, the corporate structure, and the legislative provisions provide more than reasonable security with respect to records in British Columbia." It also noted that "all reasonable steps to ensure the confidentiality of the information which Maximus will receive in order to discharge its contractual obligations. Privacy is not absolute." Case name is BC Govt Serv. Empl. Union v. British Columbia (Minister of Health Services).
A very interesting decision since it may set the standard for the privacy issues and protections to consider when creating a data outsourcing to the United States. The case is part of an ongoing battle dating back to last summer over the Patriot Act and the protection of Canadian personal information. As I argued with Milana Homsi, the real issue is not the outsourcing of data to the U.S. Rather, it is the ability of U.S. courts to assert jurisdiction over Canadian organizations with even a small U.S. presence, which, notwithstanding PIPEDA, effectively limits the privacy protection enjoyed in Canada.