The British Columbia Freedom of Information and Protection of Privacy Act provides that personal information in the custody or control of a public body must be stored and accessed in Canada and disclosed only as permitted by the express provisions of FIPPA.
These data localization requirements were the strictest in Canada to date. Many public bodies articulated the challenges of working within these legislative restrictions, which prevented them from using technological products and services that were available to others in Canada. Various parties agitated for amendments.
For a significant number of years, the data localization requirements remained unchanged until the provincial government introduced Bill 35, the Miscellaneous Amendment Act #2 on October 7, 2019. The Act proposed amendments to Section 33 of FIPPA to allow increased access and storage of personal information outside of Canada in specific prescribed circumstances. The amendments proposed to facilitate the use of certain cloud computing services for public bodies governed by FIPPA.
In particular, the amendments permit processing personal information outside of Canada so long as the personal information is not “intentionally accessed” by an individual, and so long as it does not result in the storage of personal information outside of Canada, other than personal information that is metadata. In addition, such access outside of Canada must be temporary and limited to the minimum period of time necessary to complete the processing. There are also specific requirements for metadata.
The B.C. Privacy Commissioner issued an open letter expressing concern about the text of the proposed amendments. In summary, the commissioner stated that the proposed amendments were broader than required to meet the purpose of allowing for some processing of personal information outside of Canada for the purpose of cloud computing.
After very limited debate, the proposed amendments remained unchanged. The Act passed 3rd Reading on October 29, 2019 and received Royal Assent on October 31, 2019. The new provisions are now in force (See Section 33.1(1)(p), (p.1) and (p.2)).
Altogether, the changes constitute an incremental, although important amendment to the data localization requirements in B.C.’s FIPPA.
Keri L. Bennett is a Partner at Roper Greyell LLP.