Under Personal Information Protection and Electronic Documents Act (PIPEDA), there is nothing that prevents organizations from outsourcing the processing of data inside or outside of Canada—however, organizations must take all reasonable steps to protect that information from unauthorized uses and disclosures when it is in the hands of third party processors. This is where accountability, the first principle in PIPEDA, comes in; and there are obligations to meet regarding training staff that are highly relevant.
Existing laws, policies and practices are insufficient to meet the twin challenges of protecting individual privacy and providing public access to information in the digital age. “Bold leadership” is needed...
Irvin Leroux fought the Canada Revenue Agency for 18 years over allegations of unpaid taxes and gross negligence. Despite losing some of Leroux’s original documents, the CRA eventually claimed he owed close to a million dollars in taxes, penalties and interest for three years when he was starting his RV park business in British Columbia.