The Office of the Privacy Commissioner of Canada has released a consultation paper that signals a major shift in its position on data transfers, indicating that it now believes that cross-border disclosures of personal information require prior consent. The approach is a significant reversal of longstanding policy that relied upon the accountability principle to ensure that organizations transferring personal information to third parties are ultimately responsible for safeguarding that information. In fact, OPC guidelines from January 2009 explicitly stated that “assuming the information is being used for the purpose it was originally collected, additional consent for the transfer is not required.”
Cooperation in the Pacific Rim by Jakob Polacsek, World Economic Forum (CC BY-NC-SA 2.0) https://www.flickr.com/photos/worldeconomicforum/48179628441
The digital policy implications of the USMCA have attracted increasing attention as Canadians consider the risks that the agreement could limit future policy flexibility. In particular, the agreement restricts the use of data localization, an increasingly popular legal method for addressing public interest concerns associated with the collection of online information by mandating that data be stored within the local jurisdiction. Restrictions on data localization are not entirely new to Canada, since similar provisions are found in the CPTPP (the successor to the Trans Pacific Partnership). That means that Canada has already agreed to limits on data localization with or without the USMCA. However, the USMCA’s data localization provision differs in a significant way, suggesting that the Canadian government has agreed to an even more restrictive approach than that found in the CPTPP.
The United States-Mexico-Canada Agreement (USMCA) is more than just an updated version of the North American Free Trade Agreement. With the inclusion of a digital trade chapter, the deal sets a new standard for e-commerce that seems likely to proliferate in similar agreements around the world. My Washington Post op-ed notes that negotiators have touted the benefits of addressing modern forms of commerce, but the reality is that the USMCA digital trade chapter raises many concerns, locking in rules that will hamstring online policies for decades by restricting privacy safeguards and hampering efforts to establish new regulation in the digital environment.
Earlier this month, CIGI posted my essay contribution to its series on data governance in the digital age. Data Rules in Modern Trade Agreements: Toward Reconciling an Open Internet with Privacy and Security Safeguards focuses on the policy challenges associated with including data provisions in trade agreements such as the TPP and NAFTA. I also sat down with CIGI for a short video on the essay. It is embedded below.
The Canadian government and other TPP partners released the text of most of the CPTPP yesterday. The release contained few surprises as the TPP remains intact and a new annex identifies the suspended provisions. The list of suspended provisions was revealed several months ago and is particularly notable for the suspension of IP provisions such as copyright term extension, patent term adjustment, technological protection measures, biologics protection, and Internet safe harbour rules.