Law / Canada / Nova Scotia
Personal Information International Disclosure Protection Act, storage, access and disclosure outside Canada
S.N.S. 2006, c. 3, ss. 2(1)(g), 5, 9
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://nslegislature.ca/sites/default/files/legc/statutes/persinfo.htmIn force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Security
As of .
What it requires
- If you are a public body, or a service provider retained under a contract to perform services for a public body, or an associate of a service provider, ensure that personal information in your custody or under your control is stored only in Canada and accessed only in Canada, unless the individual consented in the prescribed manner, the storage or access is for a disclosure the Act allows, or the head of the public body has allowed storage or access outside Canada (s. 5(1)).
- As a service provider, in providing storage, access or disclosure of personal information outside Canada, collect and use only the personal information necessary to fulfil your obligation as a service provider and at all times make reasonable security arrangements to protect it (s. 5(4)).
- Disclose personal information outside Canada only as section 9 permits, including with the individual's written consent, under an enactment or treaty that authorizes or requires the disclosure, or for the purposes section 9(2) lists (s. 9).
These lines are LexLint's reading of the law's text, as of .
What this law does
A public body must ensure that personal information in its custody or under its control is stored only in Canada and accessed only in Canada, and a service provider or an associate of a service provider must ensure the same of the personal information in its custody or under its control, unless the individual consented in the prescribed manner, the storage or access is for a disclosure the Act allows, or the head of the public body has allowed storage or access outside Canada.
A service provider is a person retained under a contract to perform services for a public body who, in the course of performing them, uses, discloses, manages, stores or accesses personal information in the custody or under the control of the public body. The head of a public body may allow storage or access outside Canada, subject to any restrictions or conditions the head considers advisable, if the head considers it necessary to meet the requirements of the public body's operation.
In providing storage, access or disclosure of personal information outside Canada, a service provider must collect and use only the personal information necessary to fulfil its obligation as a service provider and must at all times make reasonable security arrangements to protect the personal information it collects or uses for a public body.
A public body, service provider or associate of a service provider must ensure that personal information in its custody or under its control is disclosed outside Canada only as the Act permits. The Act came into force on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, makes high-risk automated decisions, processes voice recordings, processes biometric data, operates a social platform, serves under-18s, operates an app store, ships a mobile app or reuses other publishers' content.