PIPEDA & Canadian Consumers – Where Does Your Business Host Its Email?
While last Friday’s post (PIPEDA & Client Data Security – How the Canadian Privacy Acts Impacts the Cloud) briefly touched on the the class action lawsuit filed against CIBC in 2004 by Canadian Visa cardholders when they learned their data was available to US authorities via the Patriot Act, this was not the only time that Canadian consumers have acted litigiously in regards to their data being stored south of the border. While PIPEDA and similar provincial regulations allow the storage of Canadian information on international soil, it is obvious that Canadian consumers are not comfortable with foreign governments having complete access to their correspondence and account data.

In 2008, canada.com email subscribers brought the parent company CanWest to court, when the provider decided to outsource the service to a third-party US firm. From the PIPEDA Case Summary 2008-394 –

In 2008, canada.com email subscribers brought the parent company CanWest to court, when the provider decided to outsource the service to a third-party US firm. From the PIPEDA Case Summary 2008-394 –
Two complainants expressed doubt that subscribers’ personal information was adequately protected after canada.com e-mail operations were outsourced to a U.S.-based firm. Moreover, the complainants did not believe that existing subscribers had had an opportunity to consent to the transfer of their information to the U.S. or that new subscribers were properly informed that their information would be used and stored in the U.S.
The Office of the Privacy Commissioner of Canada recognizes and shares the continued interest that Canadians and Canadian businesses have in the flow of their personal information beyond our borders….
The present Case Summary addresses several of the same issues and summarizes the Office’s position:
- The Personal Information Protection and Electronic Documents Act (the Act) does not prohibit organizations from outsourcing their operations across international borders.
- It is important for organizations to assess the risks that could jeopardize the security and confidentiality of customer personal information when it is transferred to foreign-based third-party service providers. The measures by which personal information is protected by a foreign-based firm must be formalized with the organization by using contractual or other means.
- No contract or contractual provision can override the laws of a country to which the information could be subject once the information has been transferred.
- Organizations must be transparent about their personal information handling practices. A company in Canada that outsources personal information processing to a company that operates in another country should notify its customers that the information may be available to the government of that country or its agencies under a lawful order made in that country.
- With regard to the issue of customer consent, the Office has taken the position that the sharing of information with a third-party service provider constitutes a “use” for the purposes of the Act…. Although service providers may change over time, if the purpose of the current provider’s use of the personal information has remained the same, organizations are not required to obtain renewed customer consent for the information use.
The Office’s investigation established that existing subscribers were informed in advance that their new log-in to their account would be an opportunity for them to accept or reject the terms of the services. New e-mail subscribers were also informed, both of information transfers to the U.S.-based provider and of potential privacy implications.While the courts did rule on the side of the email provider, what is interesting to note (at least as a Canadian consumer of email products) is that these email users had been offered the choice to either have their email moved to the US email provider’s servers or have their accounts and all of their associated data deleted entirely — neither an option that many of us would find palatable and certainly not if those accounts contained business correspondence. The question becomes whether Canadian businesses (and solo entrepeneurs) should be using internationally based email providers, given consumer sentiment about government interference with their data (and the US Patriot Act in particular) or whether they should be investigating Canada-based email solutions like ImogoMail?
The Assistant Privacy Commissioner was satisfied that canada.com had fulfilled its obligations to provide comparable protection under the Act by putting in place adequate contractual provisions. She noted that since the third party in this case is a U.S. company operating in that country, it is subject to U.S. laws, some of which could compel that company to disclose to U.S. authorities information in its possession.
As a business owner, do you know where your business data email is stored? As a Canadian consumer, do you privacy concerns about how businesses use and store account data? We’d love to hear about it in the comments!
Want to learn more about where Imogo stores its data? Visit the RackForce Gigacenter – environmentally powered and securely located in the heart of British Columbia.