Organizations in Alberta that utilize service providers outside Canada to manage personal information should be aware of several recent amendments made to Alberta’s Personal Information Protection Act (“PIPA”). These amendments came into effect on May 1, 2010.
As a result of these amendments, PIPA now requires that all organizations comply with additional notification procedures prior to having a service provider outside Canada collect personal information on their behalf and prior to transferring personal information to such a service provider. In addition, organizations must develop privacy policies and practices regarding the use of personal information by service providers outside Canada acting on the organization’s behalf and the organization must have written information about these and all of its privacy policies and practices available upon request.
This bulletin reviews the implications of these amendments.
