Personal Information Protection Act, service providers outside Canada
S.A. 2003, c. P-6.5, ss. 6 (2), 13.1
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://kings-printer.alberta.ca/documents/Acts/P06P5.pdfIn force since .
A cross border transfer rule binding private bodies.
- Enforcement body
- Information and Privacy Commissioner of Alberta
- Obligation class
- Disclosure, Transfer
As of .
What it requires
- If you use a service provider outside Canada to collect, use, disclose or store personal information for you, include in your policies and practices the countries outside Canada in which that is occurring or may occur and the purposes for which the service provider has been authorized to collect, use or disclose personal information.
- Before or at the time of collecting personal information with the individual's consent through a service provider outside Canada, or of transferring to one personal information that was collected with the individual's consent, notify the individual in writing or orally.
- In that notice, tell the individual how to obtain access to written information about your policies and practices on service providers outside Canada, and give the name or position name or title of a person who can answer the individual's questions about the collection, use, disclosure or storage of personal information by those providers.
- Give this notice in addition to the notice of purposes you owe under section 13 when you collect personal information from the individual.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 59(1)(a) makes it an offence to collect, use or disclose personal information in contravention of Part 2, which includes section 13.1, and section 59(2) sets the fine.
Penalty structure
Section 59(2) sets the fine for an offence under section 59(1) at not more than $100,000 for a person other than an individual and not more than $10,000 for an individual.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 100,000
What this law does
If an organization uses a service provider outside Canada to collect, use, disclose or store personal information for or on behalf of the organization, its policies and practices must include information about the countries outside Canada in which the collection, use, disclosure or storage is occurring or may occur and the purposes for which the service provider outside Canada has been authorized to collect, use or disclose personal information.
An organization that uses a service provider outside Canada to collect personal information about an individual with the individual's consent must notify the individual before or at the time of collecting the information. An organization that transfers to a service provider outside Canada personal information that was collected with the individual's consent must likewise notify the individual before or at the time of the transfer.
The notice must tell the individual how to obtain access to written information about the organization's policies and practices with respect to service providers outside Canada. It must also give the name or position name or title of a person who can answer the individual's questions about the collection, use, disclosure or storage of personal information by service providers outside Canada. The notice under section 13.1 is in addition to any notice required under section 13.
The regulations may exempt organizations from all or part of section 13.1. The Commissioner announced on that organizations would be required to notify people when transferring personal information to a service provider outside of Canada.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, operates a social platform, serves under-18s, operates an app store, ships a mobile app or reuses other publishers' content.